Vulnerability Description
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cocoapods | Trunk.Cocoapods.Org | < 2023-10-27 |
Related Weaknesses (CWE)
References
- https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023Vendor Advisory
- https://evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#vuExploitThird Party Advisory
- https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-52gf-m7v9-m333Third Party Advisory
- https://github.com/CocoaPods/trunk.cocoapods.org/commit/d4fa66f49cedab449af9a56aPatch
- https://blog.cocoapods.org/CocoaPods-Trunk-RCEs-2023Vendor Advisory
- https://evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#vuExploitThird Party Advisory
- https://github.com/CocoaPods/CocoaPods/security/advisories/GHSA-52gf-m7v9-m333Third Party Advisory
- https://github.com/CocoaPods/trunk.cocoapods.org/commit/d4fa66f49cedab449af9a56aPatch
FAQ
What is CVE-2024-38367?
CVE-2024-38367 is a vulnerability with a CVSS score of 8.2 (HIGH). trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipula...
How severe is CVE-2024-38367?
CVE-2024-38367 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-38367?
Check the references section above for vendor advisories and patch information. Affected products include: Cocoapods Trunk.Cocoapods.Org.