Command Injection in Composer Perforce::generateP4Command()

This repository is a self-contained PHP proof-of-concept for CVE-2026-40176, a command-injection issue in Composer's Perforce repository driver. The main exploit logic is in CVE202640176Test.php, which implements an object-oriented differential test: it runs the same malicious composer.json against Composer 2.9.5 (claimed vulnerable) and Composer 2.9.6 (claimed fixed), then compares outcomes. The exploit capability is local arbitrary command execution triggered when a victim runs 'composer update' on an attacker-controlled manifest containing a crafted repositories entry of type 'perforce'. The exploit works by generating a malicious p4:// URL with shell metacharacters embedded in the user/URL portion: it appends ';touch <marker> && echo <runId> > <marker>' so that when Composer constructs the underlying p4 command, the shell executes the injected commands. Successful exploitation is validated by three checks: parsing the Composer version from output, confirming the marker file exists with the expected run ID, and confirming output contains 'p4' to indicate the Perforce driver path was reached. Repository structure is small and focused: the PHP PoC file, a base composer.json used as a template, a Dockerfile that builds a reproducible lab with pinned Composer PHARs, a docker-compose.yml that can run the PoC and optionally start a Helix Core/Perforce server, plus a README documenting the vulnerability and usage. The Docker setup is primarily for reproducibility and containment; the PoC does not require a live Perforce server because the injected command is intended to fire while Composer builds/invokes the p4 command path. Overall, this is a real exploit PoC rather than a mere detector: it actively attempts command execution and demonstrates a benign side effect as proof.

Small PoC repository for an alleged Composer Perforce repository command-injection vulnerability identified as CVE-2026-40176. The repository contains only two files: a README describing the issue and reproduction steps, and a crafted composer.json that acts as the exploit artifact. There is no standalone exploit program; the exploit is triggered by running vulnerable Composer against the malicious project configuration. Core capability: the composer.json defines a repository of type 'perforce' with attacker-controlled fields. The p4user field contains the payload 'user; touch ./pwned #', intended to break out of the generated shell command and execute an arbitrary local shell command. If Composer versions prior to 2.2.27 construct Perforce CLI commands without proper escaping, running 'composer install' or 'composer update' would execute the injected command. Repository structure and purpose: README.md documents the claimed vulnerability, affected versions, vulnerable code pattern, and mitigation guidance. composer.json is the actual PoC configuration and the main entry point. The README mentions additional files (vuln-composer.phar and patched-composer.phar), but they are not present in the analyzed repository snapshot, so the repo is incomplete relative to its documentation. Notable findings: the PoC targets the local machine executing Composer rather than a remote network service directly; the attack vector is best characterized as supply-chain/configuration-driven leading to local command execution during dependency resolution. The included endpoint 'localhost:8080' is the configured Perforce server target. There is a documentation inconsistency: the README says exploitation should create '/tmp/pwned', while the actual payload in composer.json creates './pwned'. Overall, this is a plausible operational PoC configuration rather than a full exploit toolkit.

This repository is a small proof-of-concept set for command injection in Composer's Perforce VCS driver. It contains one README and three JSON files: a default composer.json plus two variant PoCs, composer.json.vector1 and composer.json.vector2. The exploit is not part of a larger framework. The core capability is arbitrary shell command execution when Composer parses a crafted perforce repository definition during operations such as 'composer install --prefer-dist'. The repository demonstrates two concrete injection vectors: (1) the perforce repository 'url' field, which is interpreted as the Perforce server/port argument and is populated with 'localhost:1666; touch /tmp/pwned_via_port'; and (2) the 'p4user' field, populated with 'user; touch /tmp/pwned_via_user #'. In both cases, shell metacharacters break out of the intended argument context and append a shell command. The README explains how to reproduce the issue in a Docker container using a vulnerable Composer image, verify absence of the marker file in /tmp, run 'composer install --prefer-dist', and then confirm successful execution by observing the created file. The exploit is operational but simple: it uses hardcoded shell commands as payloads rather than a customizable framework. There is no detection-only logic; the repository is intended to trigger exploitation directly.

This repository is a small standalone PHP proof-of-concept for CVE-2026-40176, an OS command injection issue in Composer's Perforce VCS driver. The repo contains three files: a README describing the vulnerability and usage, a malicious sample `composer.json`, and `poc.php`, which reproduces the vulnerable command-building logic. The exploit does not target a remote service directly; instead, it abuses attacker-controlled repository metadata that would be processed by a victim running vulnerable Composer versions. In `poc.php`, the `VulnerablePerforce` class mimics Composer's `generateP4Command()` behavior by concatenating unescaped user-controlled values into a shell command. The PoC sets the Perforce port to `localhost:1666; touch /tmp/pwned_rce_confirmed #`, generates a command like `p4 -u user -p localhost:1666; touch /tmp/pwned_rce_confirmed # login -s`, and executes it with `system()`. Successful exploitation is confirmed by checking for `/tmp/pwned_rce_confirmed`, then removing it. Overall, the repository's purpose is to demonstrate arbitrary command execution resulting from unsafe shell command construction in vulnerable Composer versions when processing malicious Perforce repository configuration.