CVE-2024-35242: Composer for PHP RCE Vulnerability

CVE-2024-35242 Overview

CVE-2024-35242 is a command injection vulnerability in Composer, the dependency manager for PHP. The flaw affects versions on the 2.x branch prior to 2.2.24 and 2.7.7. When composer install runs inside a Git or Mercurial repository, a specially crafted branch name is passed unsanitized into a shell command line. An attacker who controls a repository can trigger arbitrary command execution on the developer or CI host that clones and installs it. The issue is tracked under [CWE-77: Command Injection] and is documented in the GitHub Security Advisory GHSA-v9qv-c7wm-wgmf.

Critical Impact
Cloning and installing an untrusted PHP project can lead to arbitrary command execution on the host running Composer, enabling supply-chain compromise of developer workstations and CI/CD runners.

Affected Products

Composer 2.x branch prior to 2.2.24 (2.2 LTS)
Composer 2.x branch prior to 2.7.7 (mainline)
Fedora packages of Composer covered by the Fedora package announcement

Discovery Timeline

2024-06-10 - CVE-2024-35242 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-35242

Vulnerability Analysis

The vulnerability resides in src/Composer/Package/Version/VersionGuesser.php. When Composer attempts to determine the version of a feature branch, it shells out to git rev-list using a string template that includes branch names. Branch names in Git and Mercurial may contain shell metacharacters, and Composer historically interpolated them into a single command string passed to a shell. An attacker who publishes a repository containing a branch with a name such as $(payload) can have that payload executed by the shell that Composer spawns. Exploitation requires the victim to clone the malicious repository and run composer install, which is a routine workflow in PHP development and continuous integration.

Root Cause

The VersionGuesser component built a command string by substituting %candidate% and %branch% tokens directly into 'git rev-list %candidate%..%branch%'. The resulting string was executed through a shell, so any shell metacharacters present in the branch name were interpreted rather than treated as literal arguments. This is a classic argument-versus-string command construction flaw [CWE-77].

Attack Vector

The attack vector is network-based but requires user interaction in the form of cloning an untrusted repository. Typical scenarios include a developer evaluating a third-party project, a CI job that clones a forked pull request, or any automated pipeline that runs composer install against attacker-controlled source. The injected command runs with the privileges of the user invoking Composer.

php

                $featurePrettyVersion = $prettyVersion;

                // try to find the best (nearest) version branch to assume this feature's version
-                $result = $this->guessFeatureVersion($packageConfig, $version, $branches, 'git rev-list %candidate%..%branch%', $path);
+                $result = $this->guessFeatureVersion($packageConfig, $version, $branches, ['git', 'rev-list', '%candidate%..%branch%'], $path);
                $version = $result['version'];
                $prettyVersion = $result['pretty_version'];

Source: composer/composer commit 6bd43dff. The patch converts the command from a shell string into an argv array, so branch names are passed as discrete arguments to git and are never reinterpreted by the shell. A complementary fix in the 2.2 LTS branch adds the -- separator to prevent option injection, shown in commit fc57b936.

Detection Methods for CVE-2024-35242

Indicators of Compromise

Git or Mercurial branch references containing shell metacharacters such as $(, backticks, ;, |, or && in .git/refs/heads or .git/packed-refs.
Unexpected child processes spawned by php or composer during composer install, particularly shells, network utilities such as curl, wget, or nc, or interpreters such as bash -c.
Outbound connections from CI runners or developer workstations originating from a Composer process tree shortly after repository clone.

Detection Strategies

Hunt EDR telemetry for process lineages where composer or php spawn /bin/sh -c with arguments containing branch-like tokens. Behavioral AI engines such as those in Singularity Endpoint surface these anomalous developer-tool process trees.
Inspect repositories before installation using git for-each-ref --format='%(refname)' and flag refs containing characters outside [A-Za-z0-9._/-].
Centralize CI logs into a SIEM and alert on Composer exit codes accompanied by unexpected child process names. The Singularity Data Lake can normalize CI and endpoint telemetry through OCSF for cross-source correlation.

Monitoring Recommendations

Monitor composer install invocations on shared build infrastructure and capture full command lines and parent-child process relationships.
Track installations of Composer package versions across developer endpoints and reject any host still running Composer below 2.2.24 or 2.7.7.
Alert on first-time outbound network destinations from CI runners during the dependency-resolution phase of builds.

How to Mitigate CVE-2024-35242

Immediate Actions Required

Upgrade Composer to 2.2.24 on the 2.2 LTS branch or 2.7.7 on mainline across all developer workstations, container images, and CI runners.
Rebuild and republish any base images that embed Composer so downstream pipelines pull a patched binary.
Audit recent CI runs that cloned external or fork-based repositories for unexpected processes or outbound connections.

Patch Information

Fixes are provided in upstream commits 6bd43dff and fc57b936, both linked from GHSA-v9qv-c7wm-wgmf. Distribution updates are available via the Fedora package announcements (PO4MU2BC and VLPJHM2W).

Workarounds

Avoid cloning repositories from untrusted sources until Composer is upgraded.
Run composer install only inside ephemeral, network-restricted sandboxes for unverified projects.
Restrict CI jobs that build pull requests from forks to run with minimal credentials and no write access to internal artifact stores.

bash

# Upgrade Composer to a patched release
composer self-update 2.7.7
# Or for the 2.2 LTS branch
composer self-update 2.2.24

# Verify the installed version
composer --version