A New PHP Composer Bug Could Enable Widespread Supply-Chain Attacks

guest Guest

A New PHP Composer Bug Could Enable Widespread Supply-Chain Attacks
April 29, 2021
https://thehackernews.com/2021/04/a-new-php-composer-bug-could-enable.html

The maintainers of Composer, a package manager for PHP, have shipped an update to address a critical vulnerability that could have allowed an attacker to execute arbitrary commands and "backdoor every PHP package," resulting in a supply-chain attack.

Tracked as CVE-2021-29472, the security issue was discovered and reported on April 22 by researchers from SonarSource, following which a hotfix was deployed less than 12 hours later.

"Fixed command injection vulnerability in HgDriver/HgDownloader and hardened other VCS drivers and downloaders," Composer said its release notes for versions 2.0.13 and 1.10.22 published on Wednesday. "To the best of our knowledge the vulnerability has not been exploited."
Click to expand...

According to SonarSource, the vulnerability stems from the way package source download URLs are handled, potentially leading to a scenario where an adversary could trigger remote command injection. As proof of this behavior, the researchers exploited the argument injection flaw to craft a malicious Mercurial repository URL that takes advantage of its "alias" option to execute a shell command of the attacker's choice.
Click to expand...

guest, Apr 30, 2021

#1

Floyd 57 Registered Member

Joined:: Mar 17, 2017

Posts:: 1,296

Location:: Europe

Shame this forum doesn't have more people that care about this, I doubt most people even know what php is besides that it's a programming language

Floyd 57, Apr 30, 2021

#2

stapp Global Moderator

Joined:: Jan 12, 2006

Posts:: 27,422

Location:: UK

I don't think it's a case of people not caring, I think it's just that not many pc users will have a need, or requirement, to use it.

Inquisitive folk can always have a read to see what it's all about if they want to.

https://www.php.net/manual/en/intro-whatis.php

stapp, Apr 30, 2021

#3

Floyd 57 Registered Member

Joined:: Mar 17, 2017

Posts:: 1,296

Location:: Europe

stapp said: ↑

I don't think it's a case of people not caring, I think it's just that not many pc users will have a need, or requirement, to use it.

Inquisitive folk can always have a read to see what it's all about if they want to.

https://www.php.net/manual/en/intro-whatis.php
Click to expand...

Did u just google that now?

Floyd 57, Apr 30, 2021

#4

Log in or Sign up

A New PHP Composer Bug Could Enable Widespread Supply-Chain Attacks

guest Guest

Floyd 57 Registered Member

stapp Global Moderator

Floyd 57 Registered Member

Useful Searches