Back to overview

CVE-2024-38366

CRITICAL Exploitation: PoC
10.0
CVSS 3.1
Description
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk.

Metadata

CVE ID
CVE-2024-38366
State
PUBLISHED
Assigner
GitHub_M
Reserved
2024-06-14 14:16 UTC
Published
2024-07-01 20:42 UTC
Last updated
2024-08-02 04:04 UTC
Primary CWE
CWE-74
CWE-74: Improper Neutralization of Special Elements in Outpu…
Vendor / Product
CocoaPods / CocoaPods
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
CocoaPods CocoaPods — < 001cc3a430e75a16307f5fd6cdff1363ad2f40f3
Weakness (CWE)
CWESourceDescription
CWE-74 cna CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (3)
Back to overview