CVE-2024-35242: Command Injection in Composer
Summary
CVE-2024-35242: Composer vulnerable to command injection via malicious git/hg branch names. Affects composer across 2 version ranges.
>= 2.0.0, < 2.2.24
>= 2.3.0, < 2.7.7
Fixed in 2.2.24 or 2.7.7, depending on the release line you run. How to fix ↓
Also tracked for
- composer · Debian:11
- composer/composer · Packagist
The same CVE-2024-35242 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a dependency manager for PHP. It is widely used in PHP projects to manage and install dependencies. It provides a convenient way to declare, install, and update project dependencies. However, versions 2.x prior to 2.2.24 and 2.7.7 of Composer are vulnerable to command injection when running the composer install command inside a git/hg repository with specially crafted branch names. This vulnerability can be exploited by cloning untrusted repositories.
Vulnerability Detail
The vulnerability in Composer arises from a lack of proper input validation when processing branch names during the composer install command. An attacker can create a malicious repository with specially crafted branch names that contain arbitrary commands. When an unsuspecting user clones and installs dependencies from this repository using Composer, the malicious commands can be executed on the user's system. This can lead to various security risks, including remote code execution, data loss, and unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.2.242.2.24 -
>= 2.3.0, < 2.7.72.7.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid cloning potentially compromised repositories. It is important to only clone and install dependencies from trusted sources. Exercise caution when working with unfamiliar or untrusted repositories.
Conclusion
The command injection vulnerability in Composer can be mitigated by updating to the latest secure version of Composer. It is crucial to promptly apply the recommended fix to protect your PHP projects from potential security risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for composer →
FAQ
Composer is a dependency manager for PHP that simplifies the process of managing and installing dependencies in PHP projects.
The vulnerability occurs when running the composer install command inside a git/hg repository with specially crafted branch names. This allows an attacker to execute arbitrary commands on the user's system.
The vulnerability can lead to various security risks, including remote code execution, data loss, and unauthorized access to sensitive information.
To fix this vulnerability, update Composer to version 2.2.24 for 2.2 LTS or 2.7.7 for the mainline. These versions include patches that address the command injection issue.
As a temporary workaround, avoid cloning potentially compromised repositories. Only clone and install dependencies from trusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer.
