Critical Code Execution Vulnerability in Composer Package
Summary
CVE-2024-35241: Composer is a dependency manager for PHP. Affects composer across 3 version ranges.
< 2.0.9-2+deb11u3
< b93fc6ca437da35ae73d667d0618749c763b67d4
< ee28354ca8d33c15949ad7de2ce6656ba3f68704
Fixed in 2.0.9-2+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a widely-used dependency manager for PHP, enabling developers to manage libraries and dependencies in their projects efficiently. It allows for easy installation, updating, and removal of packages, streamlining the development process. However, certain versions of Composer are vulnerable to a code execution flaw that can be exploited through specially crafted branch names in git repositories.
Vulnerability Detail
The vulnerability arises in Composer versions 2.x prior to 2.2.24 and 2.7.7, where commands such as 'status', 'reinstall', and 'remove' can be manipulated to execute arbitrary code. This issue is particularly concerning for projects that install dependencies directly from git repositories, as attackers can craft malicious branch names that trigger code execution when these commands are run. The potential ramifications include unauthorized access, data breaches, and compromise of the entire application.
How To Fix
Minimum fixed version
2.0.9-2+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid installing dependencies directly from git repositories. Instead, use the following command to prefer distribution packages: 'composer install --prefer-dist'. Alternatively, set the preferred installation method in your Composer configuration by adding the following line to your 'composer.json': '"preferred-install": "dist"'.
Conclusion
The vulnerability in Composer poses a significant risk to PHP applications that rely on git-based dependencies. By upgrading to the latest secure versions and implementing the recommended workarounds, developers can protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for composer →
FAQ
Composer versions 2.x prior to 2.2.24 and 2.7.7 are affected by this vulnerability.
Failure to update Composer may leave your application vulnerable to code execution attacks, potentially leading to unauthorized access and data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, you can mitigate the risk by avoiding the installation of dependencies via git and using the '--prefer-dist' option instead.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer.
