Command Injection in composer - CVE-2024-35241

Vulnerability identifier: #VU91684

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-35241

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the "status", "reinstall" and "remove" commands within git branch name. A remote attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

composer
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
Fedora
SUSE Linux Enterprise Server 15 SP4 LTSS
Web and Scripting Module
openSUSE Leap
Ubuntu
Anolis OS
composer (Ubuntu package)
composer (Debian package)
php-composer2
composer
composer-doc

Install updates from vendor's website.

composer - addressed in versions 2.2.24, 2.7.7
composer (Ubuntu package) - addressed in versions 1.0.0~beta2-1ubuntu0.1~esm2, 1.6.3-1ubuntu0.1~esm2, 1.10.1-1ubuntu0.1~esm2, 2.2.6-2ubuntu4+esm1, 2.7.1-2ubuntu0.1~esm1
composer (Debian package) - addressed in versions 2.0.9-2+deb11u3, 2.5.5-1+deb12u2
php-composer2 - addressed in versions 2.2.3-150400.3.12.1, 2.6.4-150600.3.3.1, 2.6.4-150600.3.12.1
composer - update to 2.7.1-3
composer-doc - update to 2.7.1-3
composer - addressed in versions 2.7.7-1.el9, 2.7.7-1.fc39, 2.7.7-1.fc40

• https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
• https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
• https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
• https://github.com/composer/composer/releases/tag/2.2.24
• https://github.com/composer/composer/releases/tag/2.7.7

• Multiple vulnerabilities in Composer
• Fedora 39 update for composer
• Fedora EPEL 9 update for composer
• Fedora 40 update for composer
• SUSE update for php-composer2
• SUSE update for php-composer2
• Debian update for composer
• Anolis OS update for composer
• Ubuntu update for composer
• SUSE update for php-composer2