4 ms·

I found this bug! Here's my blog post about it: https://justi.cz/security/2021/04/20/cocoapods-rce.html https://justi.cz/security/2021/04/20/cocoapods-rce.html

I found this bug! Here's my blog post about it: https://justi.cz/security/2021/04/20/cocoapods-rce.html https://justi.cz/security/2021/04/20/cocoapods-rce.html I started looking because I wanted to find bugs in Signal for iOS, which uses CocoaPods: https://github.com/signalapp/Signal-iOS/blob/master/Podfile https://github.com/signalapp/Signal-iOS/blob/master/Podfile

sigg3 5y ago
I like your shameless plug: > I’m trying to give 10,000 mosquito nets to charity! If you liked this post please consider donating a $2 mosquito net. https://giveanet.org/ https://giveanet.org/
- dgs_sgd 5y ago
  That's not a shameless plug, just a plug.
  - asddubs 5y ago
    by definition, any plug done without shame is shameless
- spondyl 5y ago
  Didn't Bill Gates purchase a heap of malaria nets only for it to turn that out that people were using them for things like fishing and generally just not using them for their intended purposes? Not to diminish the finding mind you, just that I was surprised to hear about malaria nets. https://www.nytimes.com/2015/01/25/world/africa/mosquito-nets-for-malaria-spawn-new-epidemic-overfishing.html https://www.nytimes.com/2015/01/25/world/africa/mosquito-net...
  - tclancy 5y ago
    So you're saying the world got better because of it? Why is everything some Benthamite calculus?
    - spondyl 5y ago
      > Why is everything some Benthamite calculus I don't understand what this means
      - tweetle_beetle 5y ago
        Jeremy Bentham [1] was more or less the founder of utilitarianism [2] as most people understand the notion today. It's a suggestion that everything is only done on the basis of what will result in the most benefit, ignoring the mortality of how it is achieved. [1] https://en.wikipedia.org/wiki/Jeremy_Bentham https://en.wikipedia.org/wiki/Jeremy_Bentham [2] https://en.wikipedia.org/wiki/Jeremy_Bentham https://en.wikipedia.org/wiki/Jeremy_Bentham
      - deleted 5y ago
        [deleted]
    - garblegarble 5y ago
      >So you're saying the world got better because of it? Unfortunately not - the hole size on the nets is much smaller than a normal fishing net, so it doesn't let juveniles escape, reducing the future fish population. A lot of the nets are also treated with insecticide, which means you're essentially dumping insecticide into the water, which can be dangerous to humans and toxic to fish.
      - throwanem 5y ago
        Yes, it's a shame the foundation spent so much effort on failing to adequately meet a need. One wonders what they did the year after.
rplnt 5y ago
> Then think about how much a security audit would cost. This is why some customers require various security certifications. Too bad the certifications often focus on whether your employees have three groups of characters in their passwords instead of an actual security audit with penetration testing. My point being, how to make people want a proper audit and how to commuicate you had one. From another point of view, how do you justify the cost without including the risk of being hacked? Because even in this instance, they were (probably) not hacked, and your reward was likely lower than an audit would cost.
- londons_explore 5y ago
  You put up a decent sized bug bounty. Whether or not the bounty is claimed, it shows your company either has good security, or is prepared to put a lot of resources into making it good.
  - tgsovlerkhgsel 5y ago
    This leaves out the possibility that a company puts out a bug bounty without ever paying any reporters. A company could simply dismiss most reports as duplicates, maybe even with a fake hall of fame, and get away with this for a long time.
    - mleonhard 5y ago
      Do you know of any company that has done this?
ksml 5y ago
That was really short and sweet. Thanks for the writeup!
kirby88 5y ago
I still don't get why the --upload-pack option execute its content... Seems pretty dangerous to me. How did you find that out?
- qyi 5y ago
  Because it says [--upload-pack=<exec>] in the manual. Whatever that means. The problem here is obviously that git is a user interface and not really meant to be called from code (contrary to what CLI supremacists believe).
  - kirby88 5y ago
    You explained what this option is, I was asking why.
dang 5y ago
I think it would be fair for the thread to point to your post, so I've swapped your URL in for https://blog.cocoapods.org/CocoaPods-Trunk-RCE/ https://blog.cocoapods.org/CocoaPods-Trunk-RCE/ above.

sigg3 5y ago

I like your shameless plug: > I’m trying to give 10,000 mosquito nets to charity! If you liked this post please consider donating a $2 mosquito net. https://giveanet.org/ https://giveanet.org/

dgs_sgd 5y ago
That's not a shameless plug, just a plug.
- asddubs 5y ago
  by definition, any plug done without shame is shameless
spondyl 5y ago
Didn't Bill Gates purchase a heap of malaria nets only for it to turn that out that people were using them for things like fishing and generally just not using them for their intended purposes? Not to diminish the finding mind you, just that I was surprised to hear about malaria nets. https://www.nytimes.com/2015/01/25/world/africa/mosquito-nets-for-malaria-spawn-new-epidemic-overfishing.html https://www.nytimes.com/2015/01/25/world/africa/mosquito-net...
- tclancy 5y ago
  So you're saying the world got better because of it? Why is everything some Benthamite calculus?
  - spondyl 5y ago
    > Why is everything some Benthamite calculus I don't understand what this means
    - tweetle_beetle 5y ago
      Jeremy Bentham [1] was more or less the founder of utilitarianism [2] as most people understand the notion today. It's a suggestion that everything is only done on the basis of what will result in the most benefit, ignoring the mortality of how it is achieved. [1] https://en.wikipedia.org/wiki/Jeremy_Bentham https://en.wikipedia.org/wiki/Jeremy_Bentham [2] https://en.wikipedia.org/wiki/Jeremy_Bentham https://en.wikipedia.org/wiki/Jeremy_Bentham
    - deleted 5y ago
      [deleted]
  - garblegarble 5y ago
    >So you're saying the world got better because of it? Unfortunately not - the hole size on the nets is much smaller than a normal fishing net, so it doesn't let juveniles escape, reducing the future fish population. A lot of the nets are also treated with insecticide, which means you're essentially dumping insecticide into the water, which can be dangerous to humans and toxic to fish.
    - throwanem 5y ago
      Yes, it's a shame the foundation spent so much effort on failing to adequately meet a need. One wonders what they did the year after.

rplnt 5y ago

> Then think about how much a security audit would cost. This is why some customers require various security certifications. Too bad the certifications often focus on whether your employees have three groups of characters in their passwords instead of an actual security audit with penetration testing. My point being, how to make people want a proper audit and how to commuicate you had one. From another point of view, how do you justify the cost without including the risk of being hacked? Because even in this instance, they were (probably) not hacked, and your reward was likely lower than an audit would cost.

londons_explore 5y ago
You put up a decent sized bug bounty. Whether or not the bounty is claimed, it shows your company either has good security, or is prepared to put a lot of resources into making it good.
- tgsovlerkhgsel 5y ago
  This leaves out the possibility that a company puts out a bug bounty without ever paying any reporters. A company could simply dismiss most reports as duplicates, maybe even with a fake hall of fame, and get away with this for a long time.
  - mleonhard 5y ago
    Do you know of any company that has done this?

ksml 5y ago

That was really short and sweet. Thanks for the writeup!

kirby88 5y ago

I still don't get why the --upload-pack option execute its content... Seems pretty dangerous to me. How did you find that out?

qyi 5y ago
Because it says [--upload-pack=<exec>] in the manual. Whatever that means. The problem here is obviously that git is a user interface and not really meant to be called from code (contrary to what CLI supremacists believe).
- kirby88 5y ago
  You explained what this option is, I was asking why.

dang 5y ago

I think it would be fair for the thread to point to your post, so I've swapped your URL in for https://blog.cocoapods.org/CocoaPods-Trunk-RCE/ https://blog.cocoapods.org/CocoaPods-Trunk-RCE/ above.