CVE-2024-35242 Composer vulnerable to command injection via malicious git/hg branch names

2024-06-1021:23:44

CWE-77

GitHub_M

www.cve.org

cve-2024-35242

dependency manager

php

command injection

composer install

git

mercurial

repository

patch

lts

mainline

clone

untrusted repositories

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

Percentile

15.5%

JSON

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

CNA Affected

[
  {
    "vendor": "composer",
    "product": "composer",
    "versions": [
      {
        "version": ">= 2.0, < 2.2.24",
        "status": "affected"
      },
      {
        "version": ">= 2.3, < 2.7.7",
        "status": "affected"
      }
    ]
  }
]