{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-24821", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-31T16:28:17.944Z", "datePublished": "2024-02-08T23:54:04.058Z", "dateUpdated": "2024-08-01T23:28:12.804Z"}, "containers": {"cna": {"title": "Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer", "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h"}, {"name": "https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5", "tags": ["x_refsource_MISC"], "url": "https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5"}], "affected": [{"vendor": "composer", "product": "composer", "versions": [{"version": ">= 2.0, < 2.2.23", "status": "affected"}, {"version": ">= 2.3, < 2.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-08T23:54:04.058Z"}, "descriptions": [{"lang": "en", "value": "Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide lateral user movement or malicious code execution when Composer is invoked within a directory with tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer on untrusted projects, Shared environments with developers who run Composer individually on the same project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the patched versions are applied at the earliest convenience. Where not possible, the following should be addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and avoid running Composer within an untrusted directory, or if needed, verify that the contents of `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code. A reset can also be done on these files by the following:```sh\nrm vendor/composer/installed.php vendor/composer/InstalledVersions.php\ncomposer install --no-scripts --no-plugins\n```"}], "source": {"advisory": "GHSA-7c6p-848j-wh5h", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:12.804Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h"}, {"name": "https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABFF8B5F-7C4A-4D4A-8BA4-31288D642194", "versionEndExcluding": "2.2.23", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*", "matchCriteriaId": "04E48189-BFEC-410C-863C-B3A7AD233152", "versionEndExcluding": "2.7.0", "versionStartIncluding": "2.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide lateral user movement or malicious code execution when Composer is invoked within a directory with tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer on untrusted projects, Shared environments with developers who run Composer individually on the same project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the patched versions are applied at the earliest convenience. Where not possible, the following should be addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and avoid running Composer within an untrusted directory, or if needed, verify that the contents of `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code. A reset can also be done on these files by the following:```sh\nrm vendor/composer/installed.php vendor/composer/InstalledVersions.php\ncomposer install --no-scripts --no-plugins\n```"}, {"lang": "es", "value": "Composer es un administrador de dependencias para el lenguaje PHP. En las versiones afectadas, se incluyen varios archivos dentro del directorio de trabajo local durante la invocaci\u00f3n de Composer y en el contexto del usuario que lo ejecuta. Como tal, bajo ciertas condiciones la ejecuci\u00f3n de c\u00f3digo arbitrario puede conducir a una escalada de privilegios locales, proporcionar movimiento lateral del usuario o ejecuci\u00f3n de c\u00f3digo malicioso cuando se invoca Composer dentro de un directorio con archivos manipulados. Todos los comandos de Composer CLI se ven afectados, incluida la actualizaci\u00f3n autom\u00e1tica de Composer.phar. Los siguientes escenarios son de alto riesgo: Composer ejecutado con sudo, Canalizaciones que pueden ejecutar Composer en proyectos que no son de confianza, Entornos compartidos con desarrolladores que ejecutan Composer individualmente en el mismo proyecto. Esta vulnerabilidad se ha solucionado en las versiones 2.7.0 y 2.2.23. Se recomienda que las versiones parcheadas se apliquen lo antes posible. Cuando no sea posible, se debe abordar lo siguiente: eliminar todos los privilegios de Sudo Composer para todos los usuarios para mitigar la escalada de privilegios de root y evitar ejecutar Composer dentro de un directorio que no sea de confianza o, si es necesario, verificar que el contenido de `vendor/composer/InstalledVersions.php ` y `vendor/composer/installed.php` no incluyen c\u00f3digo que no sea de confianza. Tambi\u00e9n se puede restablecer estos archivos mediante lo siguiente:```sh rm seller/composer/installed.php seller/composer/InstalledVersions.php Composer install --no-scripts --no-plugins ```"}], "id": "CVE-2024-24821", "lastModified": "2024-11-21T08:59:47.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2024-02-09T00:15:08.680", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "[email protected]", "type": "Secondary"}]}

{}