Archived article from 3 July 2011. Its content reflects the state of things at the time. Reconstructed from the web archive of secalert.net - view the original.
Summary. A page on apple.com inserted user-generated content into an HTML comment through an XML parsing path that mishandled declarations. By injecting an XML ATTLIST declaration inside the DOCTYPE, with the right namespace and attribute combination, it was possible to have JavaScript execute without any user interaction. Details were withheld until Apple had fixed the issue, which they did, with a credit on their security page.
Background
I found an interesting security issue on the apple.com website. The bug was based on an XML parsing error in the handling of user-generated content that was then inserted inside a comment. In short, it was possible to inject one's own declarations into an HTML comment.
XML ATTLIST declarations can be used to create attributes and assign values for matching tags inside the DOCTYPE declaration. With the right namespace and attribute combination, it was possible to craft an ATTLIST declaration that caused JavaScript to execute without any user interaction.
Proof of concept
I deliberately withheld the details until the Apple security team had fixed the issue.
Resolution
Update, July 25th 2011: The Apple security team fixed the XML injection issue and credited me at http://support.apple.com/kb/HT1318
References
- Apple security acknowledgements: support.apple.com/kb/HT1318