PTKDMobile App Security
Knowledge base / PTKD-IOS-INSECURE-EXEC
high M4 MASVS-CODE-2 static analysis PTKD-IOS-INSECURE-EXEC

Process execution via system()/exec/popen

The binary imports a process-spawning C function (system/popen/exec*). Spawning a shell is not permitted for App Store iOS apps and is a command-injection sink when reachable with attacker-influenced input.

How it's exploited

The lifted call graph shows the binary imports system()/popen()/exec*. If any attacker-influenced value (a deep-link parameter, a downloaded config, a filename) reaches that call, the attacker runs arbitrary shell commands in the app's context. Even without external input, spawning a shell is grounds for App Store rejection and a strong malware signal.

Why it matters

Arbitrary command execution and full compromise of the app's sandbox when the input is influenced; App Store rejection regardless.

How to fix it

  1. Remove system()/popen()/exec* entirely; App Store iOS apps have no legitimate reason to spawn a shell or child process.
  2. Replace the intent with a proper platform API (Foundation for files/networking, a framework for the specific task).
  3. If a dependency pulled the symbol in, update or replace that dependency.

References