CVE-2024-24821: 
PHP vulnerability analysis and mitigation

Composer, a dependency manager for PHP language, was found to be vulnerable to a security issue identified as CVE-2024-24821. The vulnerability affects versions from 2.0 up to (but not including) 2.2.23, and versions from 2.3 up to (but not including) 2.7.0. The issue was discovered and disclosed on February 8, 2024, involving several files within the local working directory that are included during Composer's invocation and executed in the context of the executing user (GitHub Advisory).

The vulnerability carries a CVSS v3.1 score of 8.8 (High), with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The issue stems from the way Composer includes files from the local working directory during its execution. All Composer CLI commands are affected, including composer.phar's self-update functionality. The vulnerability specifically involves the handling of vendor/composer/InstalledVersions.php and vendor/composer/installed.php files (NVD, GitHub Advisory).

The vulnerability can lead to arbitrary code execution under certain conditions, potentially resulting in local privilege escalation, lateral user movement, or malicious code execution when Composer is invoked within a directory containing tampered files. This is particularly critical in scenarios where Composer is run with sudo privileges, in pipelines executing Composer on untrusted projects, or in shared environments where multiple developers run Composer individually on the same project (GitHub Advisory).

The vulnerability has been patched in versions 2.7.0 and 2.2.23. For users unable to update immediately, several mitigation strategies are recommended: remove all sudo composer privileges for all users to mitigate root privilege escalation, avoid running Composer within untrusted directories, and verify the contents of vendor/composer/InstalledVersions.php and vendor/composer/installed.php for untrusted code. A reset can be performed using the commands: rm vendor/composer/installed.php vendor/composer/InstalledVersions.php followed by composer install --no-scripts --no-plugins (GitHub Advisory).