¡¾Îó²îͨ¸æ¡¿Composer ÏÂÁî×¢ÈëÎó²î£¨CVE-2022-24828£©

Ðû²¼Ê±¼ä 2022-10-08


0x00 Îó²î¸ÅÊö

CVE   ID

CVE-2022-24828

·¢Ã÷ʱ¼ä

2022-10-08

Àà    ÐÍ

ÏÂÁî×¢Èë

µÈ    ¼¶

¸ßΣ

Ô¶³ÌʹÓÃ

ÊÇ

Ó°Ïì¹æÄ£


¹¥»÷ÖØÆ¯ºó


Óû§½»»¥

ÊÇ

PoC/EXP


ÔÚҰʹÓÃ

·ñ

 

0x01 Îó²îÏêÇé

ComposerÊÇPHPµÄÒÀÀµÖÎÀíÆ÷ ¡£¡£¡£¡£¡£¡£¡£

4Ô£¬£¬£¬£¬£¬£¬ £¬ComposerÐÞ¸´ÁËÒ»¸ö²ÎÊý×¢ÈëÎó²î£¨CVE-2022-24828£©£¬£¬£¬£¬£¬£¬ £¬¸ÃÎó²îµÄCVSSÆÀ·ÖΪ8.8 ¡£¡£¡£¡£¡£¡£¡£

´øÓÐÓû§¿ØÖƵÄ$file»ò$identifier²ÎÊýµÄComposerÒªÁìVcsDriver::getFileContent()ÈÝÒ×Êܵ½²ÎÊý×¢ÈëÎó²îµÄÓ°Ï죬£¬£¬£¬£¬£¬ £¬ÈôÊÇʹÓÃMercurial»òGitÇý¶¯£¬£¬£¬£¬£¬£¬ £¬Ôò¿ÉʹÓøÃÎó²îÖ´ÐÐí§ÒâÏÂÁî ¡£¡£¡£¡£¡£¡£¡£±ðµÄ£¬£¬£¬£¬£¬£¬ £¬¸ÃÎó²îÒ²Ó°ÏìÁËPackagist.orgºÍPrivate Packagist£¬£¬£¬£¬£¬£¬ £¬²¢¿ÉÄܵ¼Ö¹©Ó¦Á´¹¥»÷ ¡£¡£¡£¡£¡£¡£¡£

 

Ó°Ïì¹æÄ£

Composer °æ±¾ < 1.10.26

2.0 <= Composer °æ±¾ < 2.2.12

2.3 <= Composer °æ±¾ < 2.3.5

 

0x02 Çå¾²½¨Òé

ÏÖÔÚ¸ÃÎó²îÒѾ­ÐÞ¸´£¬£¬£¬£¬£¬£¬ £¬ÊÜÓ°ÏìÓû§¿ÉÒÔÉý¼¶µ½Composer 1.10.26¡¢2.2.12¡¢2.3.5»ò¸ü¸ß°æ±¾ ¡£¡£¡£¡£¡£¡£¡£

ÏÂÔØÁ´½Ó£º

https://github.com/composer/composer

 

0x03 ²Î¿¼Á´½Ó

https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6

https://blog.sonarsource.com/securing-developer-tools-a-new-supply-chain-attack-on-php/

https://blog.packagist.com/cve-2022-24828-composer-command-injection-vulnerability/

 

0x04 °æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

ÐÞ¸ÄÄÚÈÝ

V1.0

2022-10-09

Ê×´ÎÐû²¼

 

 

0x05 ¸½Â¼

¼øºÚµ£±£Íø¼ò½é

¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬£¬ £¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ ¡£¡£¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò» ¡£¡£¡£¡£¡£¡£¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬£¬£¬£¬ £¬¹«Ë¾Ô±¹¤½ü4000ÈË£¬£¬£¬£¬£¬£¬ £¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË ¡£¡£¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬£¬ £¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ ¡£¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊÐ ¡£¡£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©

¶àÄêÀ´£¬£¬£¬£¬£¬£¬ £¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬£¬ £¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬£¬ £¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢ ¡£¡£¡£¡£¡£¡£¡£

 

¹ØÓÚ¼øºÚµ£±£Íø

¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ ¡£¡£¡£¡£¡£¡£¡£

¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬£¬£¬£¬ £¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º

image.png