CVE-2023-41336: Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
Impact Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices.
Affected applications are any that use:
A custom querybuilder option to limit the valid results; AND An EntityType with 'autocomplete' => true or a custom AsEntityAutocompleteField.
Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with querybuilder.
Patches
The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
Workarounds Upgrade to version 2.11.2 or greater of symfony/ux-autocomplete or perform extra validation after submit to verify the selected option is valid.
Other sources
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the impact of CVE-2023-41336?
An attacker could submit an entity id that is not part of the valid choices.
Which applications are affected by CVE-2023-41336?
Any application that uses a custom query_builder option to limit valid results and includes an EntityType with autocomplete enabled.
How can I fix CVE-2023-41336?
Update to version 2.11.2 of Symfony/ux-autocomplete package.
What is the severity of CVE-2023-41336?
The severity is medium (CVSS score 6.5).
Where can I find more information about CVE-2023-41336?
You can find more information at the following references: [link1](https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x), [link2](https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770c), [link3](https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax).