En resumen
- CVE-2022-24828 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a composer/composer, composer (getcomposer), tenable.sc (tenable).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.9%, mayor que el 79.5% de las vulnerabilidades.
- Solución: actualizar a 2.2.12, 2.3.5, 1.10.26, 5.21.0 o posterior.
| Package | Affected versions | Patched versions |
|---|
| composer/composer Packagist | ≥ 2.0, < 2.2.12≥ 2.3, < 2.3.5< 1.10.26
| 2.2.122.3.51.10.26
|
| composer | ≥ 2.0.0, < 2.2.12≥ 2.3.0, < 2.3.5< 1.10.26
| 2.2.122.3.51.10.26
|
| tenable.sc | < 5.21.0
| 5.21.0
|
Description
The Composer method VcsDriver::getFileContent() with user-controlled $file or $identifier arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.
This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json readme field as a vector for injecting parameters into the $file argument for the Mercurial driver or via the $identifier argument for the Git and Mercurial drivers.
Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.
To the best of our knowledge, this was not actively exploited. The vulnerability has been patched on Packagist.org and Private Packagist within a day of the vulnerability report.
NVD description
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.
Más vulnerabilidades de composer/composer
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free