Remote Code Execution via web-accessible composer.phar
Package
Affected versions
<1.10.27 || >=2.0,<2.2.21 || >=2.3,<2.6.4
Patched versions
2.6.4, 2.2.21, 1.10.27
Description
Credits
-
thomas-chauchefoin-sonarsource Reporter
thomas-chauchefoin-sonarsource
Reporter
Impact
Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has
register_argc_argvenabled in php.ini.Patches
2.6.4, 2.2.21 and 1.10.27 patch this vulnerability.
Workarounds
Make sure
register_argc_argvis disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.