NetSight
IP …
high8.3

CVE-2022-24828

Missing input validation can lead to command execution in composer

Impact

The Composer method `VcsDriver::getFileContent()` with user-controlled `$file` or `$identifier` arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used. This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json `readme` field as a vector for injecting parameters into the `$file` argument for the Mercurial driver or via the `$identifier` argument for the Git and Mercurial drivers. Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json. To the best of our knowledge, this was not actively exploited. The vulnerability has been patched on Packagist.org and Private Packagist within a day of the vulnerability report.

Affected packages

EcosystemPackageAffectedFixed in
composercomposer/composer< 1.10.261.10.26

Affected products

VendorProductAffected versions
GetcomposerComposer
before 1.10.26
from 2.0.0 before 2.2.12
from 2.3.0 before 2.3.5
TenableTenable.Sc
before 5.21.0
FedoraprojectFedora
Versions 34, 35, 36

Weakness classification

CWE-20CWE-88CWE-94

References