CVE-2023-43655: Remote Code Execution via web-accessible composer.phar

Published Sep 29, 2023
·
Updated

Impact

Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has registerargcargv enabled in php.ini.

Patches

2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.

Workarounds

Make sure registerargcargv is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.

Other sources

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure registerargcargv is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Affected Software

9 affected componentsFixes available
Getcomposer Composer<1.10.27
Getcomposer Composer>=2.0.0<2.2.21
Getcomposer Composer>=2.3.0<2.6.4
composer/composer/composer>=2.3.0<2.6.4
2.6.4
composer/composer/composer>=2.0.0<2.2.22
2.2.22
composer/composer/composer<1.10.27
1.10.27
Fedoraproject Fedora=37
Fedoraproject Fedora=38
Debian Debian Linux=10.0

Event History

Sep 29, 2023
CVE Published
via MITRE·07:33 PM
Data Sourced
via MITRE·07:33 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·08:39 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the impact of CVE-2023-43655?

Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a PHP file may be impacted if PHP also has register_argc_argv enabled in php.ini.

2

How can I patch CVE-2023-43655?

You can patch this vulnerability by updating Composer to version 2.6.4, 2.2.22, or 1.10.27.

3

Are there any workarounds for CVE-2023-43655?

To mitigate this vulnerability, ensure that register_argc_argv is disabled in php.ini or restrict access to the composer.phar file.

4

What is the severity of CVE-2023-43655?

The severity of this vulnerability is medium with a CVSS score of 6.4.

5

Where can I find more information about CVE-2023-43655?

You can find more information about CVE-2023-43655 in the following references: - [GitHub Security Advisory](https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf) - [GitHub Commit 1](https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d) - [GitHub Commit 2](https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c)

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203