CVE-2024-24821: Composer Arbitrary Code Execution Vulnerability
Summary
CVE-2024-24821: Composer is a dependency Manager for the PHP language. Affects composer across 2 version ranges.
>= 2.0.0, < 2.2.23
>= 2.3.0, < 2.7.0
Fixed in 2.2.23 or 2.7.0, depending on the release line you run. How to fix ↓
Also tracked for
- composer · Debian:11
- composer/composer · Packagist
The same CVE-2024-24821 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a dependency Manager for the PHP language. It is widely used in PHP projects to manage and install dependencies. Composer allows developers to define the libraries their project depends on and manages the installation and updating of these libraries. It is a crucial tool in the PHP ecosystem, enabling developers to easily integrate third-party libraries into their projects.
Vulnerability Detail
In affected versions of Composer, several files within the local working directory are included during the invocation of Composer and in the context of the executing user. This can lead to arbitrary code execution with the privileges of the user running Composer. An attacker can exploit this vulnerability to escalate their privileges, move laterally within the system, or execute malicious code. All Composer CLI commands are affected, including composer.phar's self-update. The following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer on untrusted projects, Shared environments with developers who run Composer individually on the same project.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.2.232.2.23 -
>= 2.3.0, < 2.7.02.7.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the vulnerability, remove all sudo composer privileges for all users to prevent root privilege escalation. Additionally, avoid running Composer within an untrusted directory. If running Composer in an untrusted directory is necessary, verify that the contents of vendor/composer/InstalledVersions.php and vendor/composer/installed.php do not include untrusted code. If needed, reset these files by running the following command: rm vendor/composer/installed.php vendor/composer/InstalledVersions.php && composer install --no-scripts --no-plugins
Conclusion
The Composer Arbitrary Code Execution vulnerability allows for arbitrary code execution with the privileges of the user running Composer. It is crucial to update to the patched versions of Composer or follow the recommended steps to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for composer →
FAQ
Composer is a dependency Manager for the PHP language. It allows developers to manage and install dependencies in PHP projects.
This vulnerability allows arbitrary code execution with the privileges of the user running Composer. An attacker can escalate their privileges, move laterally within the system, or execute malicious code.
The vulnerability affects Composer versions 2.0.0 to 2.2.22 and versions 2.3.0 to 2.6.1.
To fix this vulnerability, update to the patched versions of Composer, specifically versions 2.7.0 and 2.2.23. If updating is not possible, remove all sudo composer privileges, avoid running Composer in untrusted directories, and verify the contents of certain files.
Yes, to mitigate the vulnerability, remove all sudo composer privileges, avoid running Composer in untrusted directories, and verify the contents of certain files. If needed, reset these files using the provided command.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer.
