CVE-2024-38366

During user registration, the trunk server validated email domain correctness by checking MX records in DNS using the rfc-822 library. This library executes a shell command to perform a DNS query. An attacker could craft an email address to inject an additional system command (command injection) that would be executed on the trunk server with root privileges. The attack required no authentication, user interaction, or special privileges — only sending a registration request with an appropriately constructed email field value.

Attackers gained full root access to the CocoaPods server and infrastructure, enabling modification of any Podspec files in the repository and allowing a supply chain attack targeting iOS and macOS applications using CocoaPods.

A patch was deployed on the server side in September 2023 via commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3. Following the incident, a full user session reset was performed. Administrators and users should review the official vendor statement at blog.cocoapods.org and verify the integrity of their dependencies according to the recommendations in the references.

The trunk.cocoapods.org server — the authentication server for the CocoaPods dependency manager. The vulnerability affected the server version running before the patch deployment (commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3).