CVE-2021-29472: Composer Dependency Manager RCE Vulnerability

CVE-2021-29472 Overview

CVE-2021-29472 is a command injection vulnerability in Composer, the widely-used dependency manager for PHP. The vulnerability exists due to improper sanitization of URLs for Mercurial repositories specified in composer.json files and package source download URLs. When Mercurial (hg) is installed on the target system, specially crafted URL values can execute arbitrary code through the HgDriver component.

While the direct impact to individual Composer users is somewhat limited—since the composer.json file is typically under their own control—the vulnerability poses significant risk to services that process user-supplied input, such as Packagist.org and Private Packagist. These services were promptly patched within 12 hours of the initial vulnerability report.

Critical Impact

Remote code execution vulnerability affecting PHP supply chain infrastructure. Attackers can execute arbitrary commands on systems running vulnerable Composer versions when processing malicious Mercurial repository URLs.

Affected Products

• Composer versions prior to 1.10.22
• Composer versions 2.x prior to 2.0.13
• Debian Linux 9.0 and 10.0
• Fedora 33 and 34

Discovery Timeline

• 2021-04-27 - CVE-2021-29472 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-29472

Vulnerability Analysis

This vulnerability is classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The root cause lies in the HgDriver component's failure to properly sanitize repository URLs before passing them to shell commands. When Composer processes a malicious Mercurial repository URL, the unsanitized input allows injection of additional command arguments or shell metacharacters.

The vulnerability affects any service or tool that utilizes Composer's VcsRepository or VcsDriver components, making it particularly dangerous in automated CI/CD pipelines and package registry services. The attack surface extends beyond direct Composer usage to any PHP application that programmatically interacts with Composer's repository handling functionality.

Root Cause

The vulnerability stems from insufficient input validation in Composer's Mercurial driver. When processing repository URLs, the HgDriver passes user-controlled URL strings to system shell commands without proper escaping or sanitization. This allows an attacker to craft malicious URLs containing shell metacharacters or additional command arguments that execute when Composer attempts to interact with the supposed Mercurial repository.

Attack Vector

The attack requires network access and is executed through specially crafted Mercurial repository URLs. An attacker can exploit this vulnerability through several vectors:

1. Malicious Package Submission: Submitting a package with a crafted repository URL to services like Packagist
2. Compromised composer.json: Including malicious URLs in a composer.json file that targets systems with Mercurial installed
3. Third-Party Repository Poisoning: Exploiting trust relationships with third-party Composer repositories

The attacker crafts a URL that, when processed by the HgDriver, results in command injection. This is possible because Mercurial is invoked with the attacker-controlled URL as an argument, and insufficient sanitization allows shell escape sequences or argument injection.

For detailed technical analysis of this supply chain attack vector, see the SonarSource Blog on Composer Attack.

Detection Methods for CVE-2021-29472

Indicators of Compromise

• Unusual Mercurial (hg) process executions initiated by PHP or Composer processes
• Suspicious command-line arguments containing shell metacharacters in hg process invocations
• Unexpected network connections originating from Composer operations
• Modified composer.json files with suspicious Mercurial repository URLs containing special characters

Detection Strategies

• Monitor process execution chains for PHP or Composer spawning unexpected child processes
• Implement file integrity monitoring on composer.json files across repositories
• Audit Composer dependency update logs for unusual repository URL patterns
• Configure SIEM rules to detect hg command executions with suspicious argument patterns

Monitoring Recommendations

• Enable verbose logging for Composer operations in production environments
• Implement network segmentation to isolate CI/CD systems that run Composer
• Deploy endpoint detection solutions capable of monitoring command injection patterns
• Regularly audit third-party Composer repository configurations for unauthorized sources

How to Mitigate CVE-2021-29472

Immediate Actions Required

• Upgrade Composer to version 1.10.22 or later for 1.x installations
• Upgrade Composer to version 2.0.13 or later for 2.x installations
• Audit existing composer.json files for suspicious Mercurial repository URLs
• Consider temporarily removing Mercurial from systems where it is not required
• Review and restrict third-party Composer repository configurations

Patch Information

The vulnerability has been addressed in Composer versions 1.10.22 and 2.0.13. Users should update their Composer installations immediately. For systems using package manager distributions, security updates are available:

• Debian: Security advisory DSA-4907 provides patched packages
• Fedora: Updated packages available via Fedora Package Announcements

For complete details, review the GitHub Security Advisory GHSA-h5h8-pc6h-jvvx.

Workarounds

• Remove or disable Mercurial (hg) from systems where it is not essential to operations
• Implement strict validation on any user input that could reach Composer repository configurations
• Use allowlists for permitted repository URLs in environments processing external packages
• Deploy web application firewalls (WAF) to filter malicious repository URL patterns in services accepting Composer configurations

# Upgrade Composer to patched version
composer self-update --2
# Verify Composer version
composer --version
# For systems using Debian package manager
sudo apt update && sudo apt install --only-upgrade composer