Thomas-Chauchefoin-Sonarsource

The issue is related to the Composer dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register argc argv` enabled in php.ini.

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification, an unauthenticated attacker can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses.

Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication, allowing them to execute arbitrary commands as `root` on CasaOS instances. This issue is related to weaknesses in the authentication procedure, specifically in the validation of JWTs.

The issue allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL, which may be realistic within enterprise security products.

The issue affects the package search handlers, `Search` and `SearchFeed`, implemented in `pkg/app/handler/packages/search.go`, allowing unauthenticated attackers to execute arbitrary SQL queries on `https://packages.gentoo.org/` via the `q` parameter. This can lead to code execution in the context of the PostgreSQL container. The issue was addressed using prepared statements to interpolate user-controlled data in SQL queries.

The issue concerns the Crypt GPG extension for PHP, where it fails to prevent additional options in GPG calls. This poses a risk for certain environments and GPG versions.

The issue allows unauthenticated users to leak the contents of files on the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This is due to insufficient path name restrictions in the PHP framework. An attacker can exploit this to execute arbitrary code remotely.

The issue is related to the incorrect sanitization of URLs for Mercurial repositories in the root composer.json and package source download URLs. This allows specifically crafted URL values to execute code in the HgDriver if hg/Mercurial is installed on the system. The impact is mainly to services passing user input to Composer, including Packagist.org and Private Packagist, as it allows users to trigger remote code execution. The vulnerability has been patched on Packagist.org and Private Packagist within 12 hours of receiving the initial vulnerability report, and based on a review of logs, it is believed that the vulnerability was not abused by anyone.