CVE-2023-41336: symfony/ux-autocomplete Prevent injection of invalid entity ids for "autocomplete" fields
Impact Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices.
Affected applications are any that use:
A custom querybuilder option to limit the valid results; AND An EntityType with 'autocomplete' => true or a custom AsEntityAutocompleteField.
Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with querybuilder.
Patches
The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
Workarounds Upgrade to version 2.11.2 or greater of symfony/ux-autocomplete or perform extra validation after submit to verify the selected option is valid.
Other sources
symfony/ux-autocomplete Prevent injection of invalid entity ids for "autocomplete" fields
— Packagist
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/ux-autocompleteto a version that resolves this vulnerability.Fixed in 2.11.2 - Upgrade
Upgrade
symfony/ux-autocompleteto a version that resolves this vulnerability.Fixed in 2.11.2 - Configuration
Configure a custom query_builder option to limit the valid results.
symfony/ux-autocomplete query_builder - Compensating control
Perform extra validation after form submission to verify that the selected entity option is valid.
Event History
Frequently Asked Questions
What is the impact of CVE-2023-41336?
An attacker could submit an entity id that is not part of the valid choices.
Which applications are affected by CVE-2023-41336?
Any application that uses a custom query_builder option to limit valid results and includes an EntityType with autocomplete enabled.
How can I fix CVE-2023-41336?
Update to version 2.11.2 of Symfony/ux-autocomplete package.
What is the severity of CVE-2023-41336?
The severity is medium (CVSS score 6.5).
Where can I find more information about CVE-2023-41336?
You can find more information at the following references: [link1](https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x), [link2](https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770c), [link3](https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax).