Critical Arbitrary Code Execution Vulnerability in Composer Package
Summary
CVE-2024-24821: Composer is a dependency Manager for the PHP language. Affects composer across 2 version ranges.
< 2.0.9-2+deb11u2
< 64e4eb356b159a30c766cd1ea83450a38dc23bf5
Fixed in 2.0.9-2+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a widely used dependency manager for the PHP programming language, enabling developers to manage libraries and packages efficiently. It simplifies the process of integrating third-party libraries into PHP projects, ensuring that the correct versions are installed and maintained. However, Composer has been found to have a critical vulnerability that can lead to arbitrary code execution under certain conditions, particularly when run in untrusted directories or with elevated privileges.
Vulnerability Detail
The vulnerability (CVE-2024-24821) arises from Composer's inclusion of files within the local working directory during its execution. This behavior can be exploited to execute arbitrary code, potentially leading to local privilege escalation, lateral user movement, or execution of malicious code. The risk is heightened in scenarios where Composer is run with sudo privileges, in shared environments, or in CI/CD pipelines that execute Composer on untrusted projects. The vulnerability affects all Composer CLI commands, including self-update operations.
How To Fix
Minimum fixed version
2.0.9-2+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider the following workarounds: 1. Remove all sudo composer privileges for all users to mitigate root privilege escalation. 2. Avoid running Composer within untrusted directories. 3. If necessary, verify that the contents of 'vendor/composer/InstalledVersions.php' and 'vendor/composer/installed.php' do not include untrusted code. You can reset these files using the following commands:
rm vendor/composer/installed.php vendor/composer/InstalledVersions.php
composer install --no-scripts --no-plugins
Conclusion
The CVE-2024-24821 vulnerability in Composer poses significant risks to systems using this dependency manager. It is crucial to update to the latest patched versions or implement the recommended workarounds to mitigate potential threats. Regular monitoring and vulnerability management practices, such as using Vulert, can help maintain the security of your applications.
See every vulnerability recorded for composer →
FAQ
CVE-2024-24821 is a critical vulnerability in Composer that allows for arbitrary code execution when Composer is run in untrusted directories or with elevated privileges.
The risks include local privilege escalation, lateral movement within a system, and the potential execution of malicious code, especially in shared or CI/CD environments.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If you cannot update Composer, ensure to remove sudo privileges, avoid running Composer in untrusted directories, and verify the integrity of specific Composer files.
The CVSS score of this vulnerability is 7.8, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for composer.
