Remote Code Execution via web-accessible composer.phar
CVE-2023-43655
6.4MEDIUM
What is CVE-2023-43655?
A remote code execution vulnerability exists in Composer, a popular PHP dependency manager. If composer.phar is published on a public web-accessible server and executed as a PHP file, an attacker can exploit this vulnerability, particularly when the register_argc_argv directive is enabled in php.ini. It is recommended that users immediately upgrade to patched versions (2.6.4, 2.2.22, and 1.10.27) to mitigate the threat. Additionally, as a precaution, disabling register_argc_argv and avoiding public exposure of composer.phar should be implemented as best practices.
Affected Version(s)
composer 2.6.4, 2.2.21, 1.10.27
composer >= 2.0, < 2.2.22 < 2.0, 2.2.22
composer < 1.10.27 < 1.10.27