Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-29472— Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer

Quick assessment

Affected
composer composer
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

composer是 开源的一个应用软件。提供一个声明，管理和安装PHP项目的依赖项。 Composer 存在参数注入漏洞，该漏洞源于composer.json和包源代码下载url没有被正确地清除。

CVSS 8.8 · High EPSS 4.75% · P92

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-29472

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer
Source: CVE Program / CVE List V5
Vulnerability Description
Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins. The main impact is to services passing user input to Composer, including Packagist.org and Private Packagist. This allowed users to trigger remote code execution. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone. Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately. Versions 1.10.22 and 2.0.13 include patches for this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Vulnerability Title
composer 参数注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
composer是 开源的一个应用软件。提供一个声明，管理和安装PHP项目的依赖项。 Composer 存在参数注入漏洞，该漏洞源于composer.json和包源代码下载url没有被正确地清除。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
composer composer < 1.10.22 -

II. Public POCs for CVE-2021-29472

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-29472

请登录查看更多情报信息。

Vendor Advisories for CVE-2021-29472 (2)

Mailing List Discussions for CVE-2021-29472 (3)

Security Blog Posts for CVE-2021-29472 (1)

Other References for CVE-2021-29472 (1)

IV. Related Vulnerabilities

Same product: composer
Same vendor: composer
Same weakness: CWE-88

V. Comments for CVE-2021-29472

No comments yet

Leave a comment