code16/sharp: Arbitrary class instantiation through the embed_key API parameter
As published by the sources
Affected packages
- code16/sharpAffected
<9.23.0 || >=10.0.0-beta.1,<10.0.0-beta.4Fixed in9.23.010.0.0-beta.4
Derived from the fixed versions above
What to do
Upgrade code16/sharp to the fixed version in your release line: 9.23.0, 10.0.0-beta.4.
composer update code16/sharp --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
Impact
An authenticated attacker can instantiate any class in the PHP application by using the embed_key parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the __construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.
Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that embed_key is a class extending SharpFormEditorEmbed before any instantiation.
Workarounds
No known workarounds.
References
- Advisoryhttps://github.com/advisories/GHSA-h24v-f482-8cwf
- Webhttps://github.com/code16/sharp/security/advisories/GHSA-h24v-f482-8cwf
- Webhttps://github.com/code16/sharp/pull/750
- Webhttps://github.com/code16/sharp/commit/dfafb44b11574e621bf0785f02c32b9866ab9923
- Webhttps://github.com/code16/sharp/releases/tag/v9.23.0
- Webhttps://github.com/code16/sharp/tree/v10.0.0-beta.4