Command injection flaw in PHP Composer allowed supply
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-29472 | Composer is a dependency manager for PHP. Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins. The main impact is to services passing user input to Composer, including Packagist.org and Private Packagist. This allowed users to trigger remote code execution. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone. Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately. Versions 1.10.22 and 2.0.13 include patches for this issue. NVD description · AI analysis pending | 8.8 | 5% | PoC |
| — |
Full article432 words · extracted from securityaffairs.com · click to collapse
A vulnerability in the PHP Composer could have allowed an attacker to execute arbitrary commands and backdoor every PHP package.
The maintainers of the PHP Composer package have addressed a critical vulnerability, tracked as CVE-2021-29472, that could have allowed an attacker to execute arbitrary commands and establish a backdoor in every PHP package.
Composer is the major tool to manage and install software dependencies, it uses the online service Packagist to determines the correct supply chain for package downloads. It has been estimated that the Packagist infrastructure serves around 1.4 billion download requests each month.
“Please immediately update Composer to version 2.0.13 or 1.10.22 (composer.phar self-update).The new releases include fixes for a command injection security vulnerability (CVE-2021-29472) reported by Thomas Chauchefoin from SonarSource.” reads the advisory published by SonarSource.
The command injection vulnerability was discovered by researchers from SonarSource who warn that it flaw could have been potentially exploited to conduct a supply-chain attack.
“During our security research, we discovered a critical vulnerability in the source code of Composer which is used by Packagist. It allowed us to execute arbitrary system commands on the Packagist.org server.” reads the post published by SonarSource, “A vulnerability in such a central component, serving more than 100M package metadata requests per month, has a huge impact as this access could have been used to steal maintainers’ credentials or to redirect package downloads to third-party servers delivering backdoored dependencies.”
The issue was reported on April 22 and the maintainers addressed it in less than 12 hours.
The vulnerability stems from improper sanitization of URLs for repositories in root composer.json files and package source download URLs that could be interpreted as options for system commands executed by Composer.
According to the researchers who discovered the issue, the flaw was introduced in November 2011.
“This problem alone does not yet allow command execution, as the values are appropriately escaped. The parameter injection has been fixed all across Composer with help by Thomas Chauchefoin from SonarSource by separating positional command arguments from options with the — separator where possible, e.g. hg clone — ‘$URL’ instead of hg clone ‘$URL’.” continues the advisory.
Below the timeline for this issue:
| Date | Action |
|---|---|
| 2021-04-22 | First contact to security (at) packagist.org |
| 2021-04-22 | A hotfix is deployed in packagist.org |
| 2021-04-26 | CVE-2021-29472 assigned by GitHub |
| 2021-04-27 | Composer 1.10.22 and 2.0.13 are released |
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, PHP Composer)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/117366/security/php-composer-flaw.html