CVE-2024-35242 Composer vulnerable to command injection via malicious git/hg branch names
Attackers can execute arbitrary commands by tricking users into cloning repositories with malicious branch names using Composer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-35242?
CVE-2024-35242 is a high-severity command injection vulnerability in composer, published on 10 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.
Weakness: CWE-77
Which versions are affected by CVE-2024-35242?
5 open source packages ship an affected version, including composer/composer and composer.
| Package | Affected | Fixed in |
|---|---|---|
composer/composer Packagist | From 2.0 | 2.2.24 |
composer/composer Packagist | From 2.0 | 2.2.24 |
composer/composer Packagist | From 2.3 | 2.7.7 |
composer/composer Packagist | From 2.3 | 2.7.7 |
composer Bitnami | From 2.0.0 | 2.2.24, 2.7.7 |
How do I fix CVE-2024-35242?
Upgrade composer/composer to a fixed version for your release line: 2.2.24 or 2.7.7.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-35242 being exploited?
There is no known exploitation of CVE-2024-35242 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BIT-composer-2024-35242, CLEANSTART-2024-DD29597, DEBIAN-CVE-2024-35242, GHSA-v9qv-c7wm-wgmf, UBUNTU-CVE-2024-35242.