Log in Start free

Vulnerability · Published Jun 10, 2024 · Assigned by GitHub_M

CVE-2024-35242Composer vulnerable to command injection via malicious git/hg branch names

High 8.8

In plain English

A high-severity command injection in composer from composer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)3.3%top 11.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20composer2.7.7-r0ALPINE-CVE-2024-35242
Alpine:v3.21composer2.7.7-r0ALPINE-CVE-2024-35242
Alpine:v3.22composer2.7.7-r0ALPINE-CVE-2024-35242
Alpine:v3.23composer2.7.7-r0ALPINE-CVE-2024-35242
Alpine:v3.24composer2.7.7-r0ALPINE-CVE-2024-35242
Debian:12composer2.5.5-1+deb12u2DSA-5715-1
Debian:12composer2.5.5-1+deb12u2DEBIAN-CVE-2024-35242
Debian:13composer2.7.7-1DEBIAN-CVE-2024-35242
Debian:14composer2.7.7-1DEBIAN-CVE-2024-35242
Packagistcomposer/composer2.2.24GHSA-v9qv-c7wm-wgmf
Packagistcomposer/composer2.7.7GHSA-v9qv-c7wm-wgmf

Affected products (as reported)

VendorProductVersions
composer composer >= 2.0, < 2.2.24>= 2.3, < 2.7.7

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References