Log in Start free

Vulnerability · Published Apr 13, 2022 · Assigned by GitHub_M

CVE-2022-24828Missing input validation can lead to command execution in composer

High 8.3

In plain English

A high-severity improper input validation in composer from composer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)1.9%top 20.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20composer2.3.5-r0ALPINE-CVE-2022-24828
Alpine:v3.21composer2.3.5-r0ALPINE-CVE-2022-24828
Alpine:v3.22composer2.3.5-r0ALPINE-CVE-2022-24828
Alpine:v3.23composer2.3.5-r0ALPINE-CVE-2022-24828
Alpine:v3.24composer2.3.5-r0ALPINE-CVE-2022-24828
Debian:12composer2.2.12-1DEBIAN-CVE-2022-24828
Debian:13composer2.2.12-1DEBIAN-CVE-2022-24828
Debian:14composer2.2.12-1DEBIAN-CVE-2022-24828
Packagistcomposer/composer2.3.5GHSA-x7cr-6qr6-2hh6
Packagistcomposer/composer2.2.12GHSA-x7cr-6qr6-2hh6
Packagistcomposer/composer1.10.26GHSA-x7cr-6qr6-2hh6

Affected products (as reported)

VendorProductVersions
composer composer < 1.10.26>= 2.0.0, < 2.2.12>= 2.3, < 2.3.6

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References