GHSA-g6f8-c3x9-jv7f: code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.
Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.
Workarounds Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
Other sources
code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 10.0.0-beta.4 - Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 9.23.0 - Upgrade
Upgrade
code16/sharpto a version that resolves this vulnerability.Fixed in 9.23.0 - Upgrade
Upgrade
code16/sharpto a version that resolves this vulnerability.Fixed in 10.0.0-beta.4 - Configuration
Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
code16/sharp autocomplete remote callback = SharpFormAutocompleteRemoteField::setRemoteCallback()
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to call the Autocomplete API. Exploitation does not require user interaction.
Which configurations are affected?
Configurations using SharpFormAutocompleteRemoteField::setRemoteEndpoint() are affected because the endpoint validation allowed the configured endpoint to appear only as a substring. Use of setRemoteCallback() is identified as the workaround.
What versions contain a fix?
The issue is patched in version 9.23.0 and pre-release version 10.0.0-beta.4.
What can be done if upgrading is not immediately possible?
Replace SharpFormAutocompleteRemoteField::setRemoteEndpoint() with SharpFormAutocompleteRemoteField::setRemoteCallback().