CVE-2024-35241 Composer vulnerable to command injection via malicious git branch name
Attackers can execute arbitrary code via malicious git branch names when using Composer's status, reinstall, or remove commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-35241?
CVE-2024-35241 is a high-severity command injection vulnerability in composer, published on 10 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.
Weakness: CWE-77
Which versions are affected by CVE-2024-35241?
5 open source packages ship an affected version, including composer/composer and composer.
| Package | Affected | Fixed in |
|---|---|---|
composer/composer Packagist | From 2.0 | 2.2.24 |
composer/composer Packagist | From 2.0 | 2.2.24 |
composer/composer Packagist | From 2.3 | 2.7.7 |
composer/composer Packagist | From 2.3 | 2.7.7 |
composer Bitnami | From 2.0.0 | 2.2.24, 2.7.7 |
How do I fix CVE-2024-35241?
Upgrade composer/composer to a fixed version for your release line: 2.2.24 or 2.7.7.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-35241 being exploited?
There is no known exploitation of CVE-2024-35241 in the wild and no public exploit code.
Sources
Also known as BIT-composer-2024-35241, CLEANSTART-2024-ND02975, DEBIAN-CVE-2024-35241, GHSA-47f6-5gq3-vx9c, UBUNTU-CVE-2024-35241.