Runpath Search Path (@rpath) Detected in iOS App Binary in Mobile Security Framework

Question

Mugilarasan_57 OP

Created Apr ’24

Replies 1

Boosts 0

Views 1.3k

Participants 2

Hello Geeks,

After testing our iOS app using MobSF, the report highlighted that the binary has Runpath Search Path (@rpath) set. In certain cases an attacker can abuse this feature to run arbitrary executable for code execution and privilege escalation.  

The Runpath Search Path directs the dynamic linker to search for dynamic libraries (dylibs) in a specified order of paths, similar to how Unix searches for binaries in $PATH. However, this setup introduces a vulnerability wherein an attacker could place a malicious dylib in one of the initial paths, thereby hijacking the legitimate library sought by the linker.  

Despite attempting to manually strip the binary following instructions from https://inesmartins.github.io/mobsf-ipa-binary-analysis-step-by-step/index.html, the same warnings persist in the report. We urgently seek assistance in resolving this issue and eagerly await your response.

Boost

Answer 1

DTS Engineer OP

Apple

Apr ’24

It’s absolutely standard to use rpath-relative references on iOS. If your iOS app has any embedded frameworks or dynamic libraries [1], you must reference those via an rpath-relative reference. If your third-party tooling isn’t aware of that, you should discuss that with your vendor.

For more background on rpath-relative references, see Dynamic Library Standard Setup for Apps.

In general, a rule highlighting rpath-relatively references is pointless on iOS and its child platforms. That’s because those platforms always act like you have library validation enabled.

This check might make sense on macOS, where it’s possible to run without library validation. Indeed, Gatekeeper runs exactly this check on macOS. See Resolving Gatekeeper Problems Caused by Dangling Load Command Paths.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] In general iOS does not support dynamic libraries in third-party code. The only exception to this rule is the Swift system libraries provided by Xcode.

0