CVE-2024-38366 CoacoaPods trunk RCE in email verification system rfc-822
Attackers can execute arbitrary commands on the CocoaPods trunk server via email verification, gaining root access and modifying podspecs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-38366?
CVE-2024-38366 is a critical command injection vulnerability in CocoaPods, published on 1 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk.
Weakness: CWE-74
Which versions are affected by CVE-2024-38366?
It affects 1 product.
Products include Cocoapods Trunk.cocoapods.org.
How do I fix CVE-2024-38366?
No fix has been published for CVE-2024-38366 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-38366 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-38366 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in CocoaPods
Sources
Also known as GHSA-x2x4-g675-qg7c.