|
| 1 | +--- |
| 2 | +layout: post |
| 3 | +title: "CocoaPods Trunk: Minor security updates" |
| 4 | +author: orta |
| 5 | +categories: cocoapods trunk |
| 6 | +--- |
| 7 | + |
| 8 | +Hey folks, strange enough we got two separate security folks pointing out the same flaw in Trunk within a week of each other. I've shipped the fixes a month ago, it's worth both explaining what was fixed and giving credit to the two researchers: [splitline](https://github.com/splitline) from [DEVCORE](https://devco.re/en/) and [Joshua Rogers](https://joshua.hu/) from [AISLE](https://aisle.com/) Research Team. |
| 9 | + |
| 10 | +<!-- more --> |
| 11 | + |
| 12 | +When you sign up to CocoaPods trunk, rather than having you set up a password in the CLI we email you a token which you click to verify your current session as being valid. So, you would register by running this command: |
| 13 | + |
| 14 | +``` |
| 15 | +> pod trunk register orta.therox@gmail.com |
| 16 | +[!] Please verify the session by clicking the link in the verification email that has been sent to orta.therox@gmail.com |
| 17 | +``` |
| 18 | + |
| 19 | +That triggers a verification email, which would have looked like : |
| 20 | + |
| 21 | +``` |
| 22 | +Hi Orta Therox, |
| 23 | +
|
| 24 | +Please confirm your CocoaPods session by clicking the following link: |
| 25 | +
|
| 26 | + https://trunk.cocoapods.org/sessions/verify/51efd813 |
| 27 | +
|
| 28 | +If you did not request this you do not need to take any further action. |
| 29 | +
|
| 30 | +Kind regards, |
| 31 | +the CocoaPods team |
| 32 | +``` |
| 33 | + |
| 34 | +Accepting the token by clicking the link sets up the authentication for my local CLI as being verified. |
| 35 | + |
| 36 | +The flaw here is that `51efd813` is a _relatively_ small space of characters, and we didn't have any protection around someone requesting a verification for basically every possible token (e.g. `11111111` to `ffffffff`.) |
| 37 | + |
| 38 | +[splitline](https://github.com/splitline) fom DEVCORE sent me a very interesting way to think about it, with a proof of concept script by using a [birthday attack](https://en.wikipedia.org/wiki/Birthday_attack). |
| 39 | + |
| 40 | +Step 1: Register a lot of times for the email you want, to increase the odds of it working. |
| 41 | +Step 2: Send random verification requests to Trunk |
| 42 | +Step 3: Check all of the sessions to see if they were verified |
| 43 | + |
| 44 | +With a reasonable enough amount of time, and tens of thousands of requests on each step, you can verify a token for an email address you don't own. |
| 45 | + |
| 46 | +## The fix |
| 47 | + |
| 48 | +The [Pull Request is here](https://github.com/CocoaPods/trunk.cocoapods.org/pull/601) which converts the 8 characters to 20 characters (making the search space significantly larger) and adding the verification system to our request throttler, making it much harder to search the space! |
| 49 | + |
| 50 | +### Worst case scenario |
| 51 | + |
| 52 | +Like with the [RCE in 2021](https://blog.cocoapods.org/CocoaPods-Trunk-RCE/) I can't prove this hasn't been actively used. However, just because it hasn't been proved, doesn't mean it hasn't happened. This touches code which has been in trunk since launch, and 11 years is a long time. |
| 53 | + |
| 54 | +The worst case scenario is that an attacker could have used this technique to get access to upload a CocoaPod version which contains malicious code. For a few years now we've been emailing Podspec authors when a new version comes out, so it's likely someone would have been notified if this has happened to them. |
| 55 | + |
| 56 | +### For more information |
| 57 | + |
| 58 | +We want to offer our thanks to [splitline](https://github.com/splitline) from [DEVCORE](https://devco.re/en/) and [Joshua Rogers](https://joshua.hu/) from [AISLE](https://aisle.com/) Research Team for their thorough reporting! They mentioned a few other things not noted in this blog post but we fixed around XSS and our throttler. |
| 59 | + |
| 60 | +CocoaPods is ran by a set of volunteers in their spare time. If you have any questions or comments about this advisory: |
| 61 | + |
| 62 | +- Open an issue in [the trunk repo](https://github.com/CocoaPods/trunk.cocoapods.org) |
| 63 | +- Email us at our private security email: [info@cocoapods.org](mailto:info@cocoapods.org) |
| 64 | + |
| 65 | +If you're not sure of the email address you used for a pod, use `pod trunk info [pod_name]` to see the connected email accounts. |
0 commit comments