Millions of iOS and macOS applications built with CocoaPods, an open-source dependency manager, have been found vulnerable to a security breach that could enable supply-chain attacks. The security breach was discovered by EVA Information Security and is centered around an insecure email verification mechanism used to authenticate developers of individual pods (libraries). This mechanism allowed attackers to manipulate the URL in a verification link to point to a malicious server, thereby gaining access to sensitive app data, such as credit card details, medical records, and private materials. The data could then be exploited for various malicious purposes, including ransomware, fraud, blackmail, and corporate espionage.
EVA Information Security's investigation revealed that approximately 3 million iOS and macOS apps built with CocoaPods have been vulnerable for nearly a decade. The exploit could have allowed attackers to insert malicious code into many popular applications, compromising the security of millions of users. CocoaPods has faced security challenges in the past. In 2021, the maintainers confirmed a vulnerability that allowed repositories to execute arbitrary code on the servers, enabling attackers to replace legitimate packages with malicious ones.
The recent discovery by EVA Information Security highlights three critical flaws in the CocoaPods dependency manager, all of which have now been patched. The first vulnerability, CVE-2024-38368, with a CVSS score of 9.3, allowed attackers to abuse the “Claim Your Pods” process to take control of a package and modify its source code. The second vulnerability, CVE-2024-38366, with a CVSS score of 10.0, exploited an insecure email verification workflow to execute arbitrary code on the Trunk server. The third, CVE-2024-38367, with a CVSS score of 8.2, involved manipulating a verification link to redirect requests to an attacker-controlled domain, thereby gaining access to developers' session tokens.
The potential impact of these vulnerabilities is profound. They posed a severe risk to downstream customers, allowing malicious actors to insert harmful code into popular iOS and macOS applications. The roots of the problem trace back to 2014, when a migration to the Trunk server left thousands of packages with unknown or unclaimed owners. Attackers could exploit this by using a public API to claim these pods and insert malicious code.
Upon discovering the vulnerabilities, EVA researchers privately notified CocoaPods developers. The CocoaPods team responded promptly, wiping all session keys to prevent unauthorized access and introducing new procedures for recovering orphaned pods. Developers are now required to contact the company directly to take control of these dependencies, enhancing security. Developers now need to re-evaluate and verify the integrity of open-source dependencies used within their applications, as well as ensure that their COCOAPODS_TRUNK_TOKEN is up-to-date for enhanced security (since outdated tokens could leave your development environment vulnerable).
In conclusion, the CocoaPods security breach highlights the importance of verifying the integrity of open-source dependencies used within applications. Developers need to take proactive steps to ensure that their applications are not vulnerable to supply-chain attacks. CocoaPods maintainers have taken steps to patch the vulnerabilities, and developers need to ensure that they are using the latest version of the dependency manager.
Frequently Asked Questions
What is the nature of the vulnerability found in CocoaPods?
The vulnerability found in CocoaPods could potentially be used for supply-chain attacks, which could compromise the security of millions of iOS and macOS applications. The vulnerability was caused by critical flaws in the CocoaPods dependency manager that could allow threat actors to take over thousands of orphaned packages, execute shell commands, and take over accounts.
How can developers check if their iOS or macOS app is affected by the CocoaPods vulnerability?
Developers can check if their iOS or macOS app is affected by the CocoaPods vulnerability by running the pod outdated command in the terminal to check for outdated dependencies. If any outdated dependencies are found, developers should update them to the latest version to mitigate the risk of the vulnerability.
What steps should be taken to mitigate the risks associated with the CocoaPods vulnerability?
To mitigate the risks associated with the CocoaPods vulnerability, developers should update all outdated dependencies to the latest version, including any orphaned packages. It is also recommended to enable two-factor authentication on all accounts associated with CocoaPods.
Has there been any reported exploitation of this vulnerability in the wild?
As of now, there have been no reported cases of exploitation of this vulnerability in the wild. However, it is important for developers to take proactive measures to mitigate the risk of potential exploitation.
What versions of CocoaPods are impacted by the security issue?
The security issue impacts all versions of CocoaPods up to and including version 1.10.2. Developers should update to version 1.10.3 or later to address the vulnerability.
Where can I find official patches or updates to address the CocoaPods vulnerability?
Developers can find official patches or updates to address the CocoaPods vulnerability on the official CocoaPods website. It is recommended to update to version 1.10.3 or later to address the vulnerability.
Focus: VPN and Privacy Software. Michael Dolinsky contributes to Impulsecās VPN and privacy software reviews by researching product features, platform compatibility, and usability considerations. At Impulsec, Michael supports editorial evaluations by helping assess performance claims, configuration complexity, and practical trade-offs across devices, using Impulsecās standardized review framework.