A near inconceivable number of Apple apps have been exposed to critical vulnerabilities in a popular dependency manager for years now.
CocoaPods is a platform that developers in Apple's ecosystem use to add and manage external libraries.
This makes the pods prime targets for hackers, and the CocoaPods platform - should it contain some underlying, platform-wide vulnerability - a bona fide money pit.
As revealed by E.V.A Information Security in a report on Monday, it turns out that the CocoaPods platform did contain a trio of serious vulnerabilities.
The most severe of them - CVE-2024-38366, a remote code execution opportunity - was assigned a critical 10 out of 10 CVSS rating.
Another remarkable bug caused by pods without owners, CVE-2024-38368, earned a critical 9.3, and an 8.2 was given to the session verification-hijacking issue CVE-2024-38367.
CocoaPods Mishandled APIs for a Decade CocoaPods was first developed and released in 2011.
Shockingly, ownership over all pods was reset.
In other words, users reclaimed their pods by simply calling dibs.
Anyone in possession of this knowledge could have, at any point from 2014 to 2023, claimed anyone else's pod for themselves, modified it however they wished, and pushed that modification to any Apple apps that use it.
E.V.A found evidence of orphaned pods in documentation for apps like Facebook, Safari, Microsoft Teams, TikTok, Snapchat, and many more.
Max-Severity RCE Bug Tied to RubyGem Ironically, CocoaPods' worst vulnerability lay with an open source component it incorporated back in 2014 for validating user email addresses.
Thanks to some vulnerable methods in the RubyGem package rfc-22, an attacker could have injected arbitrary malicious code into the address field during Trunk's account validation process.
The type of malicious code such an attacker could silently add to a pod would be limitless, and this is just one way they could take advantage of such access.
They could use such access to shut down Trunk entirely, or steal session tokens from pod owners or CocoaPods itself.
Needle in a Haystack There's no clear evidence that attackers have exploited any of the issues uncovered by the researchers and patched by CocoaPods in October.
It's worth noting that the easily concealable nature of software supply chain bugs, combined with the sheer number of pods at risk for so long, would provide ample cover to anyone who has done so.
Finding a CocoaPods exploit over the past decade would make finding a needle in a haystack seem easy, but that hasn't happened.
E.V.A recommends that any developers of apps that have relied on pods prior to last October should pursue six steps for remediation such as checking for orphaned pods and thoroughly reviewing all third-party code dependencies.
Dark Reading has also reached out to Apple for comment.
This Cyber News was published on www.darkreading.com. Publication date: Mon, 01 Jul 2024 14:20:08 +0000