CVE-2024-35241: Composer - Code Execution via Specially Crafted Branch Names
Summary
CVE-2024-35241: Composer vulnerable to command injection via malicious git branch name. Affects composer across 2 version ranges.
>= 2.0.0, < 2.2.24
>= 2.3.0, < 2.7.7
Fixed in 2.2.24 or 2.7.7, depending on the release line you run. How to fix ↓
Also tracked for
- composer · Debian:11
- composer/composer · Packagist
The same CVE-2024-35241 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a dependency manager for PHP that allows developers to manage and install packages in their PHP projects. It is widely used in the PHP ecosystem to handle dependencies and ensure the smooth functioning of PHP applications. However, Composer versions 2.x prior to 2.2.24 and 2.7.7 are vulnerable to a code execution vulnerability when using the status, reinstall, or remove commands with packages installed from source via git. This vulnerability arises from the presence of specially crafted branch names in the repository. The vulnerability allows an attacker to execute arbitrary code on the system where Composer is being used.
Vulnerability Detail
The vulnerability in Composer arises due to insufficient sanitization of branch names in git repositories. When Composer interacts with git repositories to install packages, it does not properly validate the branch names, allowing an attacker to inject malicious code. By creating a git repository with specially crafted branch names, an attacker can trigger the execution of arbitrary code during the execution of the status, reinstall, or remove commands in Composer. This can lead to remote code execution, compromising the integrity and security of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.2.242.2.24 -
>= 2.3.0, < 2.7.72.7.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can avoid installing dependencies via git by using the --prefer-dist flag or setting the preferred-install configuration option to dist. This ensures that Composer installs packages from distribution archives instead of directly from git repositories, mitigating the risk of code execution through specially crafted branch names.
Conclusion
Composer versions prior to 2.2.24 and 2.7.7 are vulnerable to a code execution vulnerability that allows attackers to execute arbitrary code on the system. To mitigate this vulnerability, it is crucial to update Composer to the latest patched version. Additionally, developers can use the provided workaround to avoid installing dependencies via git. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for composer →
FAQ
Composer is a dependency manager for PHP that allows developers to manage and install packages in their PHP projects. It simplifies the process of handling dependencies and ensures the smooth functioning of PHP applications.
The vulnerability in Composer arises due to insufficient sanitization of branch names in git repositories. When Composer interacts with git repositories to install packages, it does not properly validate the branch names, allowing an attacker to inject malicious code.
The vulnerability in Composer can lead to remote code execution, allowing an attacker to execute arbitrary code on the system where Composer is being used. This can compromise the integrity and security of the system, potentially leading to unauthorized access, data breaches, or other malicious activities.
To fix this vulnerability, it is recommended to update Composer to version 2.2.24 for 2.2 LTS or 2.7.7 for the mainline. These versions contain patches that address the code execution vulnerability. Developers should update their Composer installation to the latest patched version to ensure the security of their PHP projects.
Yes, as a temporary workaround, developers can avoid installing dependencies via git by using the --prefer-dist flag or setting the preferred-install configuration option to dist. This ensures that Composer installs packages from distribution archives instead of directly from git repositories, mitigating the risk of code execution through specially crafted branch names.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer.
