Critical PHP Composer Vulnerabilities Allow Remote Command Execution

Severity: High (Score: 64.5)

Sources: Thehackernews, Securityaffairs.Co

Summary

Two high-severity vulnerabilities in PHP Composer, a dependency manager for PHP, have been identified, allowing attackers to execute arbitrary commands. These flaws can be exploited through malicious repository configurations and crafted inputs, particularly affecting Perforce VCS. The vulnerabilities pose a significant risk to developers using PHP Composer to manage their project libraries. The exact CVEs for these vulnerabilities have not been disclosed yet. The vulnerabilities are categorized as high-severity due to their potential for remote command execution. Organizations using PHP Composer are advised to review their configurations and inputs to mitigate risks. The current status of these vulnerabilities is under investigation, with no patches mentioned as of now. Key Points: • Two high-severity vulnerabilities in PHP Composer allow remote command execution. • Attackers can exploit these flaws via malicious repository configurations. • Affected systems include those using PHP Composer with Perforce VCS.

Key Entities

• Zero-day Exploit (attack_type)
• T1059 - Command and Scripting Interpreter (mitre_attack)
• Perforce VCS (platform)
• PHP Composer (platform)