CVE-2023-43655 Remote Code Execution via web-accessible composer.phar
Remote code execution is possible if composer.phar is web-accessible and PHP register_argc_argv is enabled, requiring upgrades or configuration changes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-43655?
CVE-2023-43655 is a medium-severity code injection vulnerability in Debian Debian Linux, published on 29 Sep 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Weakness: CWE-74
Which versions are affected by CVE-2023-43655?
7 open source packages ship an affected version, including composer/composer and composer. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
composer/composer Packagist | All versions | 1.10.27 |
composer/composer Packagist | All versions | 1.10.27 |
composer/composer Packagist | From 2.0.0 | 2.2.22 |
composer/composer Packagist | From 2.0.0 | 2.2.22 |
composer/composer Packagist | From 2.3.0 | 2.6.4 |
composer/composer Packagist | From 2.3.0 | 2.6.4 |
1 more packages
composer Bitnami | All versions | 1.10.27, 2.2.21, 2.6.4 |
Linux distribution packages (5)
php-composer2 SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 2.2.3-150400.3.6.1 |
php-composer2 SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 | All versions | 2.2.3-150400.3.6.1 |
php-composer2 openSUSE:Leap 15.4 | All versions | 2.2.3-150400.3.6.1 |
php-composer2 openSUSE:Leap 15.5 | All versions | 2.2.3-150400.3.6.1 |
php-composer2 openSUSE:Tumbleweed | All versions | 2.6.4-1.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Getcomposer Composer.
How do I fix CVE-2023-43655?
Upgrade composer/composer to a fixed version for your release line: 1.10.27, 2.2.22 or 2.6.4.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-43655 being exploited?
There is no known exploitation of CVE-2023-43655 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-composer-2023-43655, CLEANSTART-2024-OM41616, DEBIAN-CVE-2023-43655, DLA-3777-1, GHSA-jm6m-4632-36hf, SUSE-SU-2023:4041-1 and 2 more.