code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
As published by the sources
Affected packages
- code16/sharpAffected
<9.23.0 || >=10.0.0-beta.1,<10.0.0-beta.4Fixed in9.23.010.0.0-beta.4
Derived from the fixed versions above
What to do
Upgrade code16/sharp to the fixed version in your release line: 9.23.0, 10.0.0-beta.4.
composer update code16/sharp --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
Impact
An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.
Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.
Workarounds
Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
References
- Advisoryhttps://github.com/advisories/GHSA-g6f8-c3x9-jv7f
- Webhttps://github.com/code16/sharp/security/advisories/GHSA-g6f8-c3x9-jv7f
- Webhttps://github.com/code16/sharp/pull/748
- Webhttps://github.com/code16/sharp/commit/339f89110f36d06eaad3f2b4bd048fa5424e5558
- Webhttps://github.com/code16/sharp/releases/tag/v9.23.0
- Webhttps://github.com/code16/sharp/tree/v10.0.0-beta.4