{"action":"created","issue":{"url":"https://api.github.com/repos/composer/composer/issues/1074","labels_url":"https://api.github.com/repos/composer/composer/issues/1074/labels{/name}","comments_url":"https://api.github.com/repos/composer/composer/issues/1074/comments","events_url":"https://api.github.com/repos/composer/composer/issues/1074/events","html_url":"https://github.com/composer/composer/issues/1074","id":6681119,"number":1074,"title":"Remote Code Execution Vulnerability via MITM.","user":{"login":"StormTide","id":819357,"avatar_url":"https://avatars.githubusercontent.com/u/819357?v=3","gravatar_id":"","url":"https://api.github.com/users/StormTide","html_url":"https://github.com/StormTide","followers_url":"https://api.github.com/users/StormTide/followers","following_url":"https://api.github.com/users/StormTide/following{/other_user}","gists_url":"https://api.github.com/users/StormTide/gists{/gist_id}","starred_url":"https://api.github.com/users/StormTide/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StormTide/subscriptions","organizations_url":"https://api.github.com/users/StormTide/orgs","repos_url":"https://api.github.com/users/StormTide/repos","events_url":"https://api.github.com/users/StormTide/events{/privacy}","received_events_url":"https://api.github.com/users/StormTide/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/composer/composer/labels/Bug","name":"Bug","color":"e10c02"},{"url":"https://api.github.com/repos/composer/composer/labels/Feature","name":"Feature","color":"02e10c"},{"url":"https://api.github.com/repos/composer/composer/labels/Schema","name":"Schema","color":"444444"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/composer/composer/milestones/9","html_url":"https://github.com/composer/composer/milestones/Backwards%20Compatible","labels_url":"https://api.github.com/repos/composer/composer/milestones/9/labels","id":524151,"number":9,"title":"Backwards Compatible","description":"Issues that may impact BC in any way and that should be completed before getting out of alpha","creator":{"login":"Seldaek","id":183678,"avatar_url":"https://avatars.githubusercontent.com/u/183678?v=3","gravatar_id":"","url":"https://api.github.com/users/Seldaek","html_url":"https://github.com/Seldaek","followers_url":"https://api.github.com/users/Seldaek/followers","following_url":"https://api.github.com/users/Seldaek/following{/other_user}","gists_url":"https://api.github.com/users/Seldaek/gists{/gist_id}","starred_url":"https://api.github.com/users/Seldaek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Seldaek/subscriptions","organizations_url":"https://api.github.com/users/Seldaek/orgs","repos_url":"https://api.github.com/users/Seldaek/repos","events_url":"https://api.github.com/users/Seldaek/events{/privacy}","received_events_url":"https://api.github.com/users/Seldaek/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":44,"state":"open","created_at":"2013-12-31T16:37:59Z","updated_at":"2015-10-12T09:10:28Z","due_on":null,"closed_at":null},"comments":36,"created_at":"2012-09-06T07:23:03Z","updated_at":"2015-11-26T10:07:25Z","closed_at":null,"body":"Composer runs code from HTTP sources without validating the source of the download or the code downloaded. As such, trivial man-in-the-middle attacks through any number of vectors (dns, networking, local server exploit, etc) will result in execution of code of an attackers choosing at the userlevel of the user running composer. (Typically a developer account)\n\nExample command to reproduce. (User)\n\n> php composer.phar self-update\n\nsrc/Composer/Command/SelfUpdateCommand.php lines 45, 50 and 59 are key. \n\nExploitation:\n\nReplace getcomposer.org for a given network perspective by replacing it with a malicious http instance (eg by changing the DNS locally, at the lan, at an isp or hosting provider dns resolver, or globally or equally easily by replacing a route to the legitimate server (eg arpspoof)) . The http server instance is configured to serve a malicious /composer.phar and a /version url that produces random data. When users run self-update, the malicious code will be downloaded and run as the user that is executing the self-update command.\n\nThe same technique can be used for any package configured over http.\n\nFix:\n\nDisable HTTP scheme's in composer and implement TLS or redesign composer to support digital signatures. (See AptSecure)"},"comment":{"url":"https://api.github.com/repos/composer/composer/issues/comments/159866433","html_url":"https://github.com/composer/composer/issues/1074#issuecomment-159866433","issue_url":"https://api.github.com/repos/composer/composer/issues/1074","id":159866433,"user":{"login":"Ocramius","id":154256,"avatar_url":"https://avatars.githubusercontent.com/u/154256?v=3","gravatar_id":"","url":"https://api.github.com/users/Ocramius","html_url":"https://github.com/Ocramius","followers_url":"https://api.github.com/users/Ocramius/followers","following_url":"https://api.github.com/users/Ocramius/following{/other_user}","gists_url":"https://api.github.com/users/Ocramius/gists{/gist_id}","starred_url":"https://api.github.com/users/Ocramius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ocramius/subscriptions","organizations_url":"https://api.github.com/users/Ocramius/orgs","repos_url":"https://api.github.com/users/Ocramius/repos","events_url":"https://api.github.com/users/Ocramius/events{/privacy}","received_events_url":"https://api.github.com/users/Ocramius/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T10:07:25Z","updated_at":"2015-11-26T10:07:25Z","body":"Note: PHP 5.6 has decent SSL/TLS. Assuming we drop (fine by me, not by pretty much everyone else) < 5.6 support, we should be ok.\r\n\r\nRef: http://php.net/manual/en/migration56.openssl.php"}}