PT-2023-9221 · Composer+7 · Composer+7
Thomas-Chauchefoin-Sonarsource
·
Published
2023-09-29
·
Updated
2025-06-30
·
CVE-2023-43655
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Composer versions prior to 1.10.27
Composer versions prior to 2.2.22
Composer versions prior to 2.6.4
Description
The issue is related to the Composer dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has
register argc argv enabled in php.ini.Recommendations
For versions prior to 1.10.27, upgrade to version 1.10.27 or later.
For versions prior to 2.2.22, upgrade to version 2.2.22 or later.
For versions prior to 2.6.4, upgrade to version 2.6.4 or later.
As a temporary workaround, consider disabling the
register argc argv setting in php.ini to minimize the risk of exploitation.
Avoid publishing composer.phar to the web as this is not best practice.Exploit
Fix
RCE
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Composer
Debian
Linuxmint
Red Os
Suse
Ubuntu