Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2024-38366

10.0 · CRITICAL

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager.

Published Jul 1, 2024CWE-74EPSS 17.79%

Overview

CVE-2024-38366 is a critical-severity vulnerability. It was published on July 1, 2024 and has a CVSS 3.1 base score of 10.0 (CRITICAL).

This vulnerability has a CVSS 3.1 base score of 10.0, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical description

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refblog.cocoapods.org/CocoaPods-Trunk-RCEs-2023Refevasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-serverGitHubgithub.com/CocoaPods/CocoaPods/security/advisories/GHSA-x2x4-g675-qg7cRefblog.cocoapods.org/CocoaPods-Trunk-RCEs-2023Refevasec.webflow.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods#2-remote-code-execution-on-the-cocoapods-trunk-serverGitHubgithub.com/CocoaPods/CocoaPods/security/advisories/GHSA-x2x4-g675-qg7c

How CyberStrike helps

Frequently asked questions

What is CVE-2024-38366?

CVE-2024-38366 is a critical-severity vulnerability. It was published on July 1, 2024 and has a CVSS 3.1 base score of 10.0 (CRITICAL).

How severe is CVE-2024-38366?

This vulnerability has a CVSS 3.1 base score of 10.0, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-38366?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-38366?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2024-38366 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related CRITICAL CVEs from 2024

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999