Read the docs
TI-2024-25624 Aliases CVE-2024-38367

CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking

Priority HIGH 74CWE-488Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.11131 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CocoaPodsCocoaPods< d4fa66f49cedab449af9a56a21ab40697b9f7b97—No fix listedCNA
  • CocoaPods VendorCocoaPods Affected < d4fa66f49cedab449af9a56a21ab40697b9f7b97 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cocoapods:trunk.cocoapods.org:*:*:*:*:ruby:*:*:*before 2023-10-27VulnerableCocoaPods
  • cpe:2.3:a:cocoapods:trunk.cocoapods.org:*:*:*:*:ruby:*:*:* Versions before 2023-10-27 Vulnerable ·CocoaPods

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-38367

References

Exploit 1

Patch 1

Advisory 2

  • TI-2024-25623 CoacoaPods trunk RCE in email verification system rfc-822 CVSS 3.1CRITICAL 10.0
  • TI-2024-25625 Trunk's 'Claim your pod' could be used to obtain un-used pods CVSS 3.1CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences