PT-2024-5209 · Cocoapods · Cocoapods

B4Rd4K + 1 · Published 2024-07-01 · Updated 2025-04-10 · CVE-2024-38367

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions: CocoaPods (affected versions not specified)

Description: The issue is related to the authentication server for the CocoaPods dependency manager, where the trunk sessions verification step could be manipulated, allowing for owner session hijacking. This could result in a full takeover of the CocoaPods trunk account, enabling the threat actor to manipulate pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-488

Related Identifiers

BDU:2024-05770

CVE-2024-38367

GHSA-52GF-M7V9-M333

Affected Products

Cocoapods

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38367.json · Exploit
• 🔥 https://evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#vulnerability-3-achieving-zero-click-account-takeover-by-defeating-email-security-boundaries · Exploit
• https://github.com/CocoaPods/trunk.cocoapods.org/commit/d4fa66f49cedab449af9a56a21ab40697b9f7b97 · Patch
• https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38367 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38367 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05770 · Security Note
• https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-52gf-m7v9-m333 · Note
• https://t.me/cvenotify/95096 · Telegram Post
• https://twitter.com/Action1corp/status/1810738388330229822 · Twitter Post
• https://xakep.ru/2024/07/03/cocoapods-problems · Note
• https://t.me/true_secator/5924 · Telegram Post
• https://t.me/cvenotify/84957 · Telegram Post
• https://evasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-server · Note
• https://twitter.com/cedwhitedragon/status/1910149750868922566 · Twitter Post