CVE-2024-35242 Composer vulnerable to command injection via malicious git/hg branch names

2024-06-1021:23:44

CWE-77

GitHub_M

github.com

cve-2024-35242

composer

php

command injection

git

repository

branch names

patch

workaround

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

CNA Affected

[
  {
    "vendor": "composer",
    "product": "composer",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.0, < 2.2.24"
      },
      {
        "status": "affected",
        "version": ">= 2.3, < 2.7.7"
      }
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
      "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*"
    ],
    "vendor": "fedoraproject",
    "product": "fedora",
    "versions": [
      {
        "status": "affected",
        "version": "39"
      },
      {
        "status": "affected",
        "version": "40"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:getcomposer:composer:2.0:*:*:*:*:*:*:*"
    ],
    "vendor": "getcomposer",
    "product": "composer",
    "versions": [
      {
        "status": "affected",
        "version": "2.0",
        "lessThan": "2.2.24",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:getcomposer:composer:2.3:*:*:*:*:*:*:*"
    ],
    "vendor": "getcomposer",
    "product": "composer",
    "versions": [
      {
        "status": "affected",
        "version": "2.3",
        "lessThan": "2.7.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]