10-Year-Old Open Source Flaw Could Affect 'Almost Every Apple Device'

storagedude shares a report from the Cyber Express: Some of the most widely used web and social media applications could be vulnerable to three newly discovered CocoaPods vulnerabilities -- including potentially millions of Apple devices, according to a report by The Cyber Express, the news service of threat intelligence vendor Cyble Inc. E.V.A Information Security researchers reported three vulnerabilities in the open source CocoaPods dependency manager that could allow malicious actors to take over thousands of unclaimed pods and insert malicious code into many of the most popular iOS and MacOS applications, potentially affecting 'almost every Apple device.' The researchers found vulnerable code in applications provided by Meta (Facebook, Whatsapp), Apple (Safari, AppleTV, Xcode), and Microsoft (Teams); as well as in TikTok, Snapchat, Amazon, LinkedIn, Netflix, Okta, Yahoo, Zynga, and many more.

The vulnerabilities have been patched, yet the researchers still found 685 Pods 'that had an explicit dependency using an orphaned Pod; doubtless there are hundreds or thousands more in proprietary codebases.' The newly discovered vulnerabilities -- one of which (CVE-2024-38366) received a 10 out of 10 criticality score -- actually date from a May 2014 CocoaPods migration to a new 'Trunk' server, which left 1,866 orphaned pods that owners never reclaimed. While the vulnerabilities have been patched, the work for developers and DevOps teams that used CocoaPods before October 2023 is just getting started. 'Developers and DevOps teams that have used CocoaPods in recent years should verify the integrity of open source dependencies used in their application code,' the E.V.A researchers said. 'The vulnerabilities we discovered could be used to control the dependency manager itself, and any published package.' 'Dependency managers are an often-overlooked aspect of software supply chain security,' the researchers wrote. 'Security leaders should explore ways to increase governance and oversight over the use these tools.' 'While there is no direct evidence of any of these vulnerabilities being exploited in the wild, evidence of absence is not absence of evidence.' the EVA researchers wrote. 'Potential code changes could affect millions of Apple devices around the world across iPhone, Mac, AppleTV, and AppleWatch devices.'

While no action is required by app developers or users, the EVA researchers recommend several ways to protect against these vulnerabilities. To ensure secure and consistent use of CocoaPods, synchronize the podfile.lock file with all developers, perform CRC validation for internally developed Pods, and conduct thorough security reviews of third-party code and dependencies. Furthermore, regularly review and verify the maintenance status and ownership of CocoaPods dependencies, perform periodic security scans, and be cautious of widely used dependencies as potential attack targets.

Read more of this story at Slashdot.