CVE-2024-38366 is a critical remote code execution (RCE) vulnerability affecting trunk.cocoapods.org, the authentication server for the CocoaPods dependency manager. The flaw stemmed from an RFC-822 library used for email validation during signup, which executed a shell command for MX record lookups that could be manipulated to execute arbitrary commands on the server. This vulnerability carries a CVSS score of 10.0 (Critical) due to its network-based attack vector, low complexity, and complete compromise potential (Confidentiality, Integrity, Availability). While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community attention and media coverage, indicating its high perceived risk. The issue was patched server-side in September 2023, but an attacker could have gained root access and manipulated any Podspec in trunk, necessitating a full user-session reset.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2023-09-22CPE matchmatch criteria | cpe:2.3:a:cocoapods:trunk.cocoapods.org:*:*:*:*:ruby:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.