Security researchers have discovered vulnerabilities in an open-source software project that could have been exploited to hack thousands of iOS and macOS apps. The threat involves CocoaPods, a widely used tool by programmers to incorporate existing software libraries into their apps. Alarmingly, CocoaPods contains three serious vulnerabilities—including a decade-old flaw—which can be exploited to secretly introduce malicious code into apps relying on CocoaPods.
CocoaPods claims to be used in over 3 million apps. “Such an attack on the mobile app ecosystem could infect almost every Apple device, leaving thousands of organizations vulnerable to catastrophic financial and reputational damage,” warns researchers at Israel-based E.V.A. Information Security.The Vulnerabilities
Of the three, the most serious flaw is CVE-2024-38366, which allowed hackers to take over unclaimed software packages, known as Pods, without going through any “ownership verification process,” the security firm says. “At this point, the attacker would be able to manipulate the source code or insert malicious content into the newly claimed Pod. This pod would then go on to infect many downstream dependencies,” E.V.A. Information Security adds.
The good news is that all three vulnerabilities were patched after E.V.A. Information Security reported the threat to CocoaPods. The fixes include “wiping all session keys” to prevent any unauthorized users from making code updates.
Despite the patches, the developers of CocoaPods can’t confirm whether hackers ever exploited the flaws to secretly make changes to any affected apps. “This touches code which has been in trunk (the centralized repository for CocoaPods) since launch, and 9 years is a long time,” a project maintainer for CocoaPods wrote in a blog post.
The discovery of these vulnerabilities highlights the potential risks associated with open-source software projects and the importance of ongoing security audits. While the patches have been applied, the incident serves as a stark reminder of the need for vigilance in securing software libraries that underpin millions of applications.
