Yikes: Security researchers have discovered vulnerabilities in an open-source software project that could have been exploited to hack thousands of iOS and macOS apps. 

The threat involves CocoaPods, which programmers use to incorporate existing software libraries into their apps. But it currently contains three serious vulnerabilities—including a decade-old flaw—which can be exploited to secretly introduce malicious code into apps that rely on CocoaPods. 

The threat is especially alarming since CocoaPods says it's used in over 3 million apps. “Such an attack on the mobile app ecosystem could infect almost every Apple device, leaving thousands of organizations vulnerable to catastrophic financial and reputational damage,” warns researchers at Israel-based E.V.A. Information Security.

(Credit: E.V.A. Information Security)

Of the three, the most serious flaw is CVE-2024-38366, which created a way for hackers to take over unclaimed software packages, known as Pods, without going through any “ownership verification process,” the security firm says. 

“At this point, the attacker would be able to manipulate the source code or insert malicious content into the newly claimed Pod. This pod would then go on to infect many downstream dependencies,” E.V.A. Information Security adds. 

The good news is that all three vulnerabilities were patched after E.V.A. Information Security reported the threat to CocoaPods. The fixes include “wiping all session keys” to prevent any unauthorized users from making code updates. 

Still, the developers of CocoaPods can’t say for sure if hackers ever exploited the flaws to secretly make changes to any affected apps. “This touches code which has been in trunk (the centralized repository for CocoaPods) since launch, and 9 years is a long time,” a project maintainer for CocoaPods wrote in a blog post.  

The news underscores how vulnerable open-source software can risk impacting an entire software ecosystem, like it did with the Apache Log4j 2 flaw in 2021. It doesn’t help that open-source projects are usually maintained with the help of volunteer programmers, leaving them more exposed to potential hacking.

In response, both Google and the White House have been pushing for a greater effort to secure open-source software projects. E.V.A. Information Security is now urging the tech industry to increase oversight of open-source tools like CocoaPods.

“While adoption of open source is practically inevitable, it also increases the risk of software supply chain attacks,” the security firm warns. Their blog post includes tips that CocoaPods users can take to ensure their code remains safe to use.