PT-2022-2529 · Composer+6 · Composer+6

Seldaek + 1 · Published 2022-04-13 · Updated 2025-06-30 · CVE-2022-24828

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Composer (affected versions not specified)

Description The issue is related to the VcsDriver::getFileContent method in Composer, a dependency manager for PHP. If a user can control the $file or $identifier argument, it may lead to a code injection vulnerability. This vulnerability can be exploited on platforms like packagist.org, where the readme field in composer.json can be used to inject parameters into hg/Mercurial via the $file argument or into git via the $identifier argument. To the best of our knowledge, this vulnerability was not actively exploited. The vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Argument Injection

Weakness Enumeration

CWE-141

CWE-20

CWE-94

CWE-88

Related Identifiers

ALT-PU-2022-1766

ALT-PU-2022-1775

BDU:2022-02944

BIT-COMPOSER-2022-24828

CVE-2022-24828

GHSA-X7CR-6QR6-2HH6

OPENSUSE-SU-2022:0132-1

OPENSUSE-SU-2022_3020-1

OPENSUSE-SU-2024:12048-1

OPENSUSE-SU-2024:12054-1

SUSE-SU-2022:3020-1

SUSE-SU-2022_3020-1

SUSE-SU-2026:1970-1

USN-7603-1

Affected Products

Alt Linux

Astra Linux

Composer

Linuxmint

Red Os

Suse

Ubuntu

References · 49

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24828.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2022-24828.yaml · Exploit
• https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF · Vendor Advisory
• https://osv.dev/vulnerability/USN-7603-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24821 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35242 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x7cr-6qr6-2hh6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24828 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG · Vendor Advisory
• https://tenable.com/security/tns-2022-09 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24828 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7603-1 · Vendor Advisory