CVE-2024-38368: CocoaPods Trunk Auth Bypass Vulnerability

CVE-2024-38368 Overview

CVE-2024-38368 is a critical authorization bypass vulnerability in the CocoaPods trunk authentication server (trunk.cocoapods.org). The vulnerability affected older pods that migrated from the pre-2014 pull request workflow to the trunk system. If these migrated pods had never been claimed by their original owners, attackers could claim ownership of them. Additionally, a flaw allowed all owners to be removed from a pod, making previously owned pods available for unauthorized claiming through the same system.

This supply chain vulnerability poses significant risks to iOS and macOS application development ecosystems, as CocoaPods is one of the most widely used dependency managers for Apple platform development.

Critical Impact

Attackers could take unauthorized ownership of orphaned or abandoned CocoaPods packages, potentially injecting malicious code into widely-used dependencies and compromising downstream applications that rely on these libraries.

Affected Products

• CocoaPods trunk.cocoapods.org (Ruby gem)

Discovery Timeline

• September 2023 - CocoaPods patched the vulnerability server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4
• 2024-07-01 - CVE-2024-38368 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-38368

Vulnerability Analysis

This vulnerability represents an authorization bypass flaw (CWE-668: Exposure of Resource to Wrong Sphere) in the CocoaPods trunk authentication server. The root cause lies in the pod ownership migration system that was implemented when CocoaPods transitioned from a pull request-based contribution model to the trunk authentication system in 2014.

The vulnerability manifests in two distinct attack scenarios. First, pods that were created under the legacy pull request workflow and subsequently migrated to trunk without being claimed remained in an "orphaned" state indefinitely. The trunk system failed to implement proper access controls to prevent unauthorized users from claiming these orphaned pods.

Second, a separate flaw in the owner management logic allowed all registered owners to be removed from a pod. Once a pod had no owners, it entered a state that could be exploited through the same claiming mechanism used for unclaimed legacy pods. This created a pathway for attackers to hijack actively maintained packages.

Root Cause

The root cause stems from inadequate authorization checks in the pod claiming functionality of trunk.cocoapods.org. The system failed to distinguish between legitimate claiming scenarios and unauthorized takeover attempts. Specifically, the claiming mechanism did not properly verify:

1. Whether a pod was intentionally released for claiming versus simply unclaimed due to the migration
2. Whether owner removal was authorized versus part of an attack chain
3. Historical ownership records that could prevent illegitimate claims

This design flaw exposed the CocoaPods ecosystem to supply chain attacks where malicious actors could claim ownership of legitimate but orphaned packages.

Attack Vector

The attack vector is network-based and requires no authentication or privileges. An attacker could exploit this vulnerability by:

1. Identifying pods that migrated from the pre-2014 workflow and were never claimed
2. Alternatively, exploiting the owner removal flaw to orphan an existing pod
3. Using the trunk API to claim ownership of the target pod
4. Publishing a malicious version of the pod containing backdoored code
5. Waiting for downstream applications to update their dependencies

The vulnerability exploits the trust relationship between developers and the CocoaPods package registry. Since the attack requires no special privileges and can be performed remotely, it represents a significant supply chain security risk. Technical details regarding the specific API calls and exploitation methodology can be found in the EvaSec Supply Chain Vulnerabilities research publication.

Detection Methods for CVE-2024-38368

Indicators of Compromise

• Unexpected ownership changes on CocoaPods packages your organization maintains
• New pod versions published without corresponding commits in the source repository
• Pod specification files modified by unknown or unauthorized users
• Discrepancies between pod version history on trunk and the official source repository

Detection Strategies

• Audit pod ownership records for all packages used in your iOS/macOS projects using pod trunk info <pod_name>
• Compare published pod specifications against the official source repositories for unauthorized modifications
• Implement dependency pinning and hash verification in your Podfile.lock to detect unexpected changes
• Monitor CocoaPods trunk activity logs for suspicious ownership claiming attempts on your packages

Monitoring Recommendations

• Set up automated alerts for any ownership changes on CocoaPods packages your organization maintains
• Regularly audit your project's dependency tree for orphaned or unmaintained pods that may be vulnerable
• Subscribe to security advisories from CocoaPods and monitor the CocoaPods Blog for vulnerability announcements
• Implement Software Composition Analysis (SCA) tools to track dependency provenance

How to Mitigate CVE-2024-38368

Immediate Actions Required

• Verify ownership of all CocoaPods packages your organization maintains using pod trunk info
• Claim any orphaned pods that belong to your organization before malicious actors can claim them
• Audit your project's Podfile.lock for any unexpected version changes or dependency modifications
• Review the source code of critical dependencies for any signs of tampering

Patch Information

This vulnerability was patched server-side by CocoaPods in September 2023 with commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4. No client-side updates are required as the fix was implemented on the trunk.cocoapods.org authentication server. Organizations should still audit their dependencies to ensure they were not compromised before the patch was applied.

For more details, refer to the CocoaPods Trunk RCEs 2023 security advisory and the GitHub Security Advisory GHSA-j483.

Workarounds

• Pin all pod versions explicitly in your Podfile to prevent automatic updates from potentially compromised packages
• Use pod trunk me to verify your session and ensure you maintain ownership of your pods
• Consider mirroring critical dependencies to internal repositories with integrity verification
• Implement code signing verification for pods where available to detect unauthorized modifications

# Verify pod ownership and claim status
pod trunk info <your-pod-name>

# List all pods associated with your account
pod trunk me

# Add additional owners to prevent orphaning
pod trunk add-owner <pod-name> <owner-email>