## https://sploitus.com/exploit?id=6FBC04CB-D1B7-5368-92D0-9FBA788FFCA6
# CVE-2026-84361: Composer’s P4PORT command execution PoC
[English version](README.en.md)
## Execution with Docker
Using Docker Compose, you can test in an isolated environment that includes Composer 2.10.2 and Perforce `p4` client. The execution container is set to network disabled, read-only, with all capabilities removed. Only tmpfs’s `/tmp` and `/work` are accessible for writing.
```bash
# Build the image (fetch the p4 from the official distribution and compare the SHA-256 hash)
docker compose build
# Test p4’s rsh: This is a direct test (default behavior)
docker compose run --rm poc
# Test using a vulnerable Composer
docker compose run --rm poc /usr/local/bin/run-composer-poc.sh
```
The last command executes `composer update --prefer-source` in the temporary working directory of the container. Since Perforce isn’t used as a marker command, Composer may fail. However, if a marker is created, it will indicate `[+] VULNERABLE` and the process will terminate successfully.
## Overview
This is a local testing PoC for CVE-2026-84361, a vulnerability present in Composer’s Perforce VCS driver. A vulnerable Composer will allow an attacker to control the `source.url` parameter, passing it as `P4PORT` to the `p4` client. `p4` treats `rsh:`/`jsh:` P4PORTs as local commands rather than network connections. Therefore, if insecure package metadata or `composer.lock` is used for source installation, commands can be executed with the privileges of the user executing Composer or the CI account. The payload simply creates a unique marker file in the temporary directory. **Discriminator: saku0512** ([GitHub](https://github.com/Saku0512))
## Notes
This tool should only be used for educational purposes and in environments where permission has been obtained. It should not be used on other systems or CI environments without permission.
## Details of the vulnerability
- **CVE ID**: CVE-2026-84361
- **Type**: OS command injection (CWE-78)
- **Affected components**: Composer, when `source.type` is `perforce`, allowing an attacker to control `source.url` as `p4` client’s `P4PORT`. `p4` treats `rsh:`/`jsh:` P4PORTs as local commands instead of network connections. Thus, if insecure package metadata or `composer.lock` is used for source installation, commands can be executed with the privileges of the user executing Composer or the CI account. This payload simply creates a unique marker file in the temporary directory. **Discriminator: saku0512** ([GitHub](https://github.com/Saku0512))
## How to use the PoC
### 1. Prerequisites
- PHP
- The Composer being tested (unpatched versions)
- Perforce `p4` client
```bash
php -v
p4 -V
```
### 2. Safe dry-run
By default, `p4` is not launched. Only the dangerous P4PORT and the intended commands are displayed.
```bash
php poc.php
```
### 3. Licensed local testing
`--execute` passes `rsh:` P4PORT to `p4`. The payload simply creates a unique marker file under `sys_get_temp_dir()`, with cleanup done automatically.
```bash
php poc.php --execute
```
If `[+] VULNERABLE` is displayed, it indicates that a local command was executed via P4PORT. To keep the marker, add `--keep-marker`.
### 4. Reproduction via Composer
The included `composer.json` is a minimal example of an inline package repository that attackers might use. In a isolated environment, unpatched Composer and `p4` will execute the following commands.
```bash
composer update --prefer-source
```
The patched version prevents `p4` from using invalid Perforce ports by rejecting `source.url` as an invalid Perforce port.
## Recommendations
Update Composer to version 2.2.30 or later. Use only reliable repositories and lock files. If no Perforce is used, remove `p4` from the PATH.
## References
- [GitHub Security Advisory: GHSA-rvx4-ffvw-m9q3](https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3)
- [Patched commit (2.10 series)](https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220)
- [Patched commit (2.2 series)](https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af)