CVE-2024-35242: Command Injection in Composer via Malicious Git/Hg Branch Names
Summary
CVE-2024-35242: Composer has multiple command injections via malicious git/hg branch names. Affects composer/composer across 2 version ranges.
>= 2.0, < 2.2.24
>= 2.3, < 2.7.7
Fixed in 2.2.24 or 2.7.7, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2024-35242 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a dependency management tool for PHP that allows developers to declare the libraries their projects depend on and manages the installation and updating of those libraries. It is widely used in the PHP ecosystem and is available on Packagist. Composer supports various version control systems, including Git and Mercurial (Hg).
Vulnerability Detail
The vulnerability identified as CVE-2024-35242 in Composer allows for multiple command injections via malicious Git/Hg branch names. When running the composer install command inside a Git/Hg repository that contains specially crafted branch names, an attacker can execute arbitrary commands. This vulnerability can be exploited if untrusted repositories are cloned. The impact of this vulnerability is considered high, with a CVSS score of 8.8. It falls under CWE-77, which is the classification for Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerabilities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0, < 2.2.242.2.24composer require composer/composer:2.2.24 -
>= 2.3, < 2.7.72.7.7composer require composer/composer:2.7.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to avoid cloning potentially compromised repositories. By exercising caution and only cloning trusted repositories, the risk of encountering this vulnerability can be mitigated.
Conclusion
The command injection vulnerability in Composer via malicious Git/Hg branch names can lead to arbitrary code execution. It is crucial to update Composer to the recommended versions to patch this vulnerability and prevent its exploitation. Exercise caution when cloning repositories to avoid potential risks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for composer/composer →
FAQ
Composer is a dependency management tool for PHP that simplifies the process of managing libraries and dependencies in PHP projects.
The vulnerability allows for command injection, which can lead to arbitrary code execution. This can result in unauthorized access, data breaches, and other malicious activities.
To fix this vulnerability, update Composer to version 2.2.24 for 2.2 LTS or 2.7.7 for the mainline.
Yes, you can mitigate the risk by avoiding cloning potentially compromised repositories.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer/composer.
