Critical Flaws in CocoaPods Expose iOS and macOS Apps to Supply Chain Attacks

A trio of security flaws has been uncovered in the CocoaPods dependency supervisor for Swift and Goal-C Cocoa initiatives that could be exploited to stage software offer chain assaults, placing downstream consumers at intense threats.

The vulnerabilities make it possible for “any malicious actor to claim possession in excess of thousands of unclaimed pods and insert destructive code into several of the most preferred iOS and macOS apps,” E.V.A Info Security scientists Reef Spektor and Eran Vaknin mentioned in a report revealed now.

The Israeli application security organization mentioned the 3 issues have due to the fact been patched by CocoaPods as of Oct 2023. It also resets all person periods at the time in reaction to the disclosures.

A single of the vulnerabilities is CVE-2024-38368 (CVSS score: 9.3), which will make it attainable for an attacker to abuse the “Claim Your Pods” course of action and choose handle of a package, successfully allowing for them to tamper with the source code and introduce malicious variations. Nonetheless, this needed that all prior maintainers have been removed from the undertaking.

The roots of the dilemma go back to 2014, when a migration to the Trunk server still left hundreds of deals with unfamiliar (or unclaimed) house owners, permitting an attacker to use a general public API for boasting pods and an email deal with that was readily available in the CocoaPods source code (“[email protected]”) to choose more than manage.

The next bug is even extra critical (CVE-2024-38366, CVSS score: 10.) and will take advantage of an insecure email verification workflow to run arbitrary code on the Trunk server, which could then be used to manipulate or swap the offers.

Also identified in the assistance is a 2nd trouble in the email address verification component (CVE-2024-38367, CVSS rating: 8.2) that could entice a recipient into clicking on a seemingly-benign verification hyperlink, when, in truth, it reroutes the ask for to an attacker-controlled domain in buy to attain entry to a developer’s session tokens.

Building matters worse, this can be upgraded into a zero-click account takeover attack by spoofing an HTTP header – i.e., modifying the X-Forwarded-Host header area – and having edge of misconfigured email security instruments.

“We have found that almost every pod proprietor is registered with their organizational email on the Trunk server, which will make them susceptible to our zero-click on takeover vulnerability,” the scientists said.

This is not the first time CocoaPods has occur beneath the scanner. In March 2023, Checkmarx unveiled that an deserted sub-area affiliated with the dependency manager (“cdn2.cocoapods[.]org”) could have been hijacked by an adversary by using GitHub Internet pages with an aim to host their payloads.

Identified this posting exciting? Observe us on Twitter  and LinkedIn to examine additional special content material we article.

Some parts of this article are sourced from:
thehackernews.com