CVE-2021-41116
📋 TL;DR
CVE-2021-41116 is a command injection vulnerability in Composer, the PHP dependency manager, affecting Windows users who install untrusted packages. Attackers can execute arbitrary commands on the system when users install malicious dependencies. Only Windows users are affected; Linux, macOS, and WSL users are not vulnerable.
💻 Affected Systems
- Composer
📦 What is this software?
Composer by Getcomposer
Composer by Getcomposer
Tenable.sc by Tenable
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to install malware, steal credentials, or pivot to other systems.
Likely Case
Local privilege escalation or arbitrary command execution in the context of the user running Composer, potentially leading to data theft or system manipulation.
If Mitigated
Limited impact if only trusted dependencies are installed or if Composer is run in a sandboxed environment.
🎯 Exploit Status
Exploitation requires user interaction to install a malicious dependency; no authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.23 or 2.1.9 and later
Vendor Advisory: https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
Restart Required: No
Instructions:
1. Update Composer using: composer self-update --stable. 2. Verify the update with: composer --version. 3. Ensure version is at least 1.10.23 or 2.1.9.
🔧 Temporary Workarounds
Avoid Untrusted Dependencies
allOnly install dependencies from trusted sources to prevent exploitation.
Use Linux or WSL
windowsSwitch to Linux, macOS, or Windows Subsystem for Linux (WSL) where this vulnerability does not exist.
🧯 If You Can't Patch
- Run Composer in a sandboxed or isolated environment (e.g., virtual machine, container) to limit potential damage.
- Implement strict access controls and monitor for suspicious command execution from Composer processes.
🔍 How to Verify
Check if Vulnerable:
Check Composer version with: composer --version. If version is below 1.10.23 for 1.x or below 2.1.9 for 2.x, and you are on Windows, you are vulnerable.Check Version:
composer --versionVerify Fix Applied:
Run: composer --version and confirm version is 1.10.23 or higher for 1.x, or 2.1.9 or higher for 2.x.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from Composer processes, especially on Windows systems.
Network Indicators:
- Outbound connections from Composer to unexpected or malicious domains.
SIEM Query:
process_name:"composer" AND command_line:*cmd* OR command_line:*powershell*🔗 References
- https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa
- https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
- https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa
- https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
