CVE-2023-43655: Remote Code Execution via web-accessible composer.phar
Impact
Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has registerargcargv enabled in php.ini.
Patches
2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.
Workarounds
Make sure registerargcargv is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.
Other sources
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure registerargcargv is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the impact of CVE-2023-43655?
Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a PHP file may be impacted if PHP also has register_argc_argv enabled in php.ini.
How can I patch CVE-2023-43655?
You can patch this vulnerability by updating Composer to version 2.6.4, 2.2.22, or 1.10.27.
Are there any workarounds for CVE-2023-43655?
To mitigate this vulnerability, ensure that register_argc_argv is disabled in php.ini or restrict access to the composer.phar file.
What is the severity of CVE-2023-43655?
The severity of this vulnerability is medium with a CVSS score of 6.4.
Where can I find more information about CVE-2023-43655?
You can find more information about CVE-2023-43655 in the following references: - [GitHub Security Advisory](https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf) - [GitHub Commit 1](https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d) - [GitHub Commit 2](https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c)