CocoaPods dependency manager for Swift and Objective-C Cocoa projects that might be used to carry out software supply chain attacks, posing serious risks for downstream customers.
The flaws enable “any malicious actor to take control of thousands of unclaimed pods and inject harmful code into many popular iOS and macOS applications,” as stated by researchers Reef Spektor and Eran Vaknin from E.V.A Information Security in a report revealed today.
The Israeli cybersecurity company stated that the three problems have already been fixed by CocoaPods as of October 2023. It also reset all user sessions at that time following the disclosures.
, allowing an attacker to exploit the “<a href=)
Claim Your Pods” process and seize control of a package, thereby enabling them to modify the source code and introduce malicious alterations. However, this condition required the removal of all previous maintainers from the project.
The issue dates back to 2014 when a transition to the Trunk server left numerous packages with unknown (or unclaimed) owners, allowing an attacker to utilize a public API for claiming pods and an email address present in the CocoaPods source code (“unclaimed-pods@cocoapods.org”) to gain control.
The second flaw, CVE-2024-38366 (CVSS score: 10.0), is even more severe and leverages an insecure email verification mechanism to execute arbitrary code on the Trunk server, which could then be used to control or replace the packages.
Another identified issue in the service is a second flaw in the email address verification component (CVE-2024-38367, CVSS score: 8.2) that could lure a recipient into clicking on an apparently harmless verification link, which in reality, redirects the request to a domain controlled by an attacker to obtain access to a developer’s session tokens.
This situation can escalate into a zero-click account takeover breach by falsifying an HTTP header – specifically altering the X-Forwarded-Host header field – and exploiting misconfigured email security utilities.
disclosed that an abandoned sub-domain linked to the dependency manager (“cdn2.cocoapods[.]org”) could have been seized by an adversary through GitHub Pages to host their malicious payloads.
Found this article interesting? Follow us on Twitter ï‚™ and LinkedIn to read more exclusive content we post.
About Author
