PT-2023-9221 · Composer+7 · Composer+7
Thomas-Chauchefoin-Sonarsource
·
Publicado
2023-09-29
·
Atualizado
2025-06-30
·
CVE-2023-43655
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Composer versions prior to 1.10.27
Composer versions prior to 2.2.22
Composer versions prior to 2.6.4
Description
The issue is related to the Composer dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has
register argc argv enabled in php.ini.Recommendations
For versions prior to 1.10.27, upgrade to version 1.10.27 or later.
For versions prior to 2.2.22, upgrade to version 2.2.22 or later.
For versions prior to 2.6.4, upgrade to version 2.6.4 or later.
As a temporary workaround, consider disabling the
register argc argv setting in php.ini to minimize the risk of exploitation.
Avoid publishing composer.phar to the web as this is not best practice.Exploit
Correção
RCE
Special Elements Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Composer
Debian
Linuxmint
Red Os
Suse
Ubuntu