CVE-2024-24821: Composer code execution and privilege escalation in composer/composer
Summary
CVE-2024-24821: Impact Several files within the local working directory are included during the invocation of Composer and in the context of the executing user. Affects composer/composer across 2 version ranges.
>= 2.0.0-alpha1, < 2.2.23
>= 2.3.0-rc1, < 2.7.0
Fixed in 2.2.23 or 2.7.0, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2024-24821 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Composer is a dependency management tool for PHP that allows developers to declare the libraries their projects depend on and manages the installation and updating of these libraries. It is widely used in the PHP ecosystem and plays a crucial role in managing dependencies for PHP applications. However, a vulnerability has been discovered in Composer that could lead to code execution and privilege escalation.
Vulnerability Detail
The vulnerability in Composer allows for arbitrary code execution and possible privilege escalation when certain conditions are met. When Composer is invoked within a directory with compromised files, such as vendor/composer/InstalledVersions.php or vendor/composer/installed.php, the included files can be tampered with to execute arbitrary code. This can lead to local privilege escalation, lateral movement, or malicious code execution. The risk is particularly high when Composer is run with elevated privileges (e.g., using sudo), in pipelines that execute Composer on untrusted projects, or in shared environments with multiple developers running Composer on the same project.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0-alpha1, < 2.2.232.2.23composer require composer/composer:2.2.23 -
>= 2.3.0-rc1, < 2.7.02.7.0composer require composer/composer:2.7.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the vulnerability, remove all sudo composer privileges for all users and avoid running Composer within an untrusted directory. If running Composer in an untrusted directory is necessary, verify that the contents of vendor/composer/InstalledVersions.php and vendor/composer/installed.php do not include any untrusted code. To reset these files, run the following commands:
rm vendor/composer/installed.php vendor/composer/InstalledVersions.php
composer install --no-scripts --no-plugins
Conclusion
The vulnerability in Composer can have serious consequences, including arbitrary code execution and privilege escalation. It is crucial to update to the patched versions (2.2.23 or 2.7.0) as soon as possible. If updating is not immediately feasible, follow the provided workarounds to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for composer/composer →
FAQ
Composer is a dependency management tool for PHP that allows developers to declare and manage the libraries their projects depend on.
The vulnerability in Composer can lead to arbitrary code execution and possible privilege escalation. This can allow an attacker to execute malicious code, gain elevated privileges, or move laterally within a system.
Composer versions from 2.0.0-alpha1 to 2.2.22 are affected. The vulnerability has been patched in versions 2.2.23 and 2.7.0.
To fix the vulnerability, update Composer to version 2.2.23 or 2.7.0. If immediate updating is not possible, remove sudo composer privileges for all users and avoid running Composer in untrusted directories. Verify the contents of vendor/composer/InstalledVersions.php and vendor/composer/installed.php for any untrusted code.
Yes, if updating Composer is not immediately feasible, you can mitigate the risk by removing sudo composer privileges for all users and avoiding running Composer in untrusted directories. Verify the contents of vendor/composer/InstalledVersions.php and vendor/composer/installed.php for any untrusted code.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer/composer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
