CVE-2024-35241: Command Injection in Composer via Malicious Git Branch Name
Summary
CVE-2024-35241: Composer has a command injection via malicious git branch name. Affects composer/composer across 2 version ranges.
>= 2.0, < 2.2.24
>= 2.3, < 2.7.7
Fixed in 2.2.24 or 2.7.7, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2024-35241 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a dependency management tool for PHP that allows developers to declare the libraries their projects depend on and manages the installation process. It is widely used in the PHP ecosystem and is available on Packagist. Composer allows packages to be installed from source via Git repositories, which can be specified in the composer.json file. This vulnerability affects Composer versions 2.0 to 2.2.23 (LTS) and 2.3 to 2.7.6 (mainline).
Vulnerability Detail
The vulnerability in Composer arises from a command injection issue when using the status, reinstall, or remove commands with packages installed from source via Git. If a malicious actor crafts a specially crafted branch name in the repository, they can execute arbitrary code on the system. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0, < 2.2.242.2.24composer require composer/composer:2.2.24 -
>= 2.3, < 2.7.72.7.7composer require composer/composer:2.7.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Composer is not immediately feasible, a workaround is to avoid installing dependencies via Git by using the --prefer-dist flag or setting the preferred-install configuration option to dist. This ensures that Composer prefers to install packages from distribution archives rather than directly from Git repositories, mitigating the risk of command injection.
Conclusion
The command injection vulnerability in Composer via malicious Git branch names can lead to serious security risks. It is crucial to update Composer to the latest patched version or apply the provided workaround to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for composer/composer →
FAQ
Composer is a dependency management tool for PHP that simplifies the process of managing libraries and their dependencies in PHP projects.
The vulnerability occurs when Composer is used to install packages from Git repositories, and a specially crafted branch name is used in the repository. This allows an attacker to execute arbitrary code on the system.
The consequences of this vulnerability include unauthorized access to the system, data leakage, and potential compromise of the affected system.
To fix this vulnerability, it is recommended to update Composer to the latest patched version (2.2.24 for LTS or 2.7.7 for mainline).
Yes, a workaround is to avoid installing dependencies via Git by using the --prefer-dist flag or setting the preferred-install configuration option to dist.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer/composer.
