Command Injection Vulnerability in Composer Package
Summary
CVE-2024-35242: Composer is a dependency manager for PHP. Affects composer across 3 version ranges.
< 2.0.9-2+deb11u3
< 6bd43dff859c597c09bd03a7e7d6443822d0a396
< fc57b93603d7d90b71ca8ec77b1c8a9171fdb467
Fixed in 2.0.9-2+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Composer is a widely used dependency manager for PHP, enabling developers to manage libraries and packages efficiently. It simplifies the process of installing, updating, and managing dependencies in PHP projects. However, vulnerabilities in Composer can lead to severe security risks, particularly when handling untrusted repositories.
Vulnerability Detail
The vulnerability CVE-2024-35242 affects Composer versions 2.x prior to 2.2.24 and 2.7.7. It arises when the composer install command is executed within a git or hg repository that has specially crafted branch names. This can lead to command injection attacks, allowing an attacker to execute arbitrary commands on the host system. The exploitation of this vulnerability requires the cloning of untrusted repositories, which can have dire consequences for the integrity and security of the affected system.
How To Fix
Minimum fixed version
2.0.9-2+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid cloning potentially compromised repositories. This can help prevent the exploitation of the command injection vulnerability until a proper update can be applied.
Conclusion
The command injection vulnerability in Composer (CVE-2024-35242) poses a significant risk to PHP applications that utilize this dependency manager. By updating to the latest versions and avoiding untrusted repositories, developers can protect their systems from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for composer →
FAQ
CVE-2024-35242 is a command injection vulnerability found in Composer versions 2.x prior to 2.2.24 and 2.7.7, which can be exploited through specially crafted branch names in untrusted repositories.
You can check your Composer version by running 'composer --version' in your terminal. If it is below 2.2.24 or 2.7.7, it is affected by this vulnerability.
Failing to update Composer can expose your system to command injection attacks, potentially allowing attackers to execute arbitrary commands and compromise your application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
