SB20261111106 - Multiple vulnerabilities in composer

Description

This security bulletin contains information about 3 vulnerabilities.

1) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to obtain a repository's inline HTTP header credential.

The vulnerability exists due to insufficiently protected credentials in Composer's repository header handling when reattaching secret-bearing headers to downloads from untrusted mirrors. A remote attacker can craft composer.lock or vendor/composer/installed.json to specify a preferred attacker-controlled download mirror and induce a victim to run composer install to receive the repository credential at that mirror.

2) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write arbitrary files outside the package directory and potentially execute arbitrary code.

The vulnerability exists due to improper symbolic link resolution in Composer's extraction fallback from unzip to ZipArchive when processing crafted ZIP archives with both unzip and the PHP zip extension available. A remote attacker can trick a victim into installing or updating a package from an attacker-controlled archive containing symlinked entries to overwrite files that execute on a subsequent request or command.

3) Unsafe reflection (CVE-ID: N/A)

CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary system commands.

The vulnerability exists due to unsafe loading of externally controlled callbacks in Composer's transport-options.prevent_url_access_callable handling when resolving downloads during composer install or composer update. A remote attacker can craft composer.lock or vendor/composer/installed.json and induce execution of either operation to run arbitrary commands before integrity checks, without installing a malicious package or executing package code.

Remediation

Install update from vendor's website.

References

• https://github.com/composer/composer/security/advisories/GHSA-x82q-x274-r6pq
• https://github.com/composer/composer/security/advisories/GHSA-w6hj-6587-3jh5
• https://github.com/composer/composer/security/advisories/GHSA-jhfp-4ppm-crmm