¡¾Îó²îͨ¸æ¡¿Composer ÏÂÁî×¢ÈëÎó²î£¨CVE-2022-24828£©
Ðû²¼Ê±¼ä 2022-10-080x00 Îó²î¸ÅÊö
CVE ID | CVE-2022-24828 | ·¢Ã÷ʱ¼ä | 2022-10-08 |
Àà ÐÍ | ÏÂÁî×¢Èë | µÈ ¼¶ | ¸ßΣ |
Ô¶³ÌʹÓà | ÊÇ | Ó°Ïì¹æÄ£ | |
¹¥»÷ÖØÆ¯ºó | Óû§½»»¥ | ÊÇ | |
PoC/EXP | ÔÚҰʹÓà | ·ñ |
0x01 Îó²îÏêÇé
ComposerÊÇPHPµÄÒÀÀµÖÎÀíÆ÷¡£¡£¡£¡£¡£¡£¡£
4Ô£¬£¬£¬£¬£¬£¬£¬ComposerÐÞ¸´ÁËÒ»¸ö²ÎÊý×¢ÈëÎó²î£¨CVE-2022-24828£©£¬£¬£¬£¬£¬£¬£¬¸ÃÎó²îµÄCVSSÆÀ·ÖΪ8.8¡£¡£¡£¡£¡£¡£¡£
´øÓÐÓû§¿ØÖƵÄ$file»ò$identifier²ÎÊýµÄComposerÒªÁìVcsDriver::getFileContent()ÈÝÒ×Êܵ½²ÎÊý×¢ÈëÎó²îµÄÓ°Ï죬£¬£¬£¬£¬£¬£¬ÈôÊÇʹÓÃMercurial»òGitÇý¶¯£¬£¬£¬£¬£¬£¬£¬Ôò¿ÉʹÓøÃÎó²îÖ´ÐÐí§ÒâÏÂÁî¡£¡£¡£¡£¡£¡£¡£±ðµÄ£¬£¬£¬£¬£¬£¬£¬¸ÃÎó²îÒ²Ó°ÏìÁËPackagist.orgºÍPrivate Packagist£¬£¬£¬£¬£¬£¬£¬²¢¿ÉÄܵ¼Ö¹©Ó¦Á´¹¥»÷¡£¡£¡£¡£¡£¡£¡£
Ó°Ïì¹æÄ£
Composer °æ±¾ < 1.10.26
2.0 <= Composer °æ±¾ < 2.2.12
2.3 <= Composer °æ±¾ < 2.3.5
0x02 Çå¾²½¨Òé
ÏÖÔÚ¸ÃÎó²îÒѾÐÞ¸´£¬£¬£¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿ÉÒÔÉý¼¶µ½Composer 1.10.26¡¢2.2.12¡¢2.3.5»ò¸ü¸ß°æ±¾¡£¡£¡£¡£¡£¡£¡£
ÏÂÔØÁ´½Ó£º
https://github.com/composer/composer
0x03 ²Î¿¼Á´½Ó
https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6
https://blog.sonarsource.com/securing-developer-tools-a-new-supply-chain-attack-on-php/
https://blog.packagist.com/cve-2022-24828-composer-command-injection-vulnerability/
0x04 °æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ÐÞ¸ÄÄÚÈÝ |
V1.0 | 2022-10-09 | Ê×´ÎÐû²¼ |
0x05 ¸½Â¼
¼øºÚµ£±£Íø¼ò½é
¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬£¬£¬£¬£¬¹«Ë¾Ô±¹¤½ü4000ÈË£¬£¬£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£¡£¡£
¹ØÓÚ¼øºÚµ£±£Íø
¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£¡£¡£¡£
¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬£¬£¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º