GHSA-g6f8-c3x9-jv7fMediumCVSS 5.4
code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
🔗 CVE IDs covered (1)
📋 Description
Impact
An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.
Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.
Workarounds
Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
🎯 Affected products2
- composer/code16/sharp:< 9.23.0
- composer/code16/sharp:>= 10.0.0-beta.1, < 10.0.0-beta.4
🔗 References (6)
- https://github.com/code16/sharp/security/advisories/GHSA-g6f8-c3x9-jv7f
- https://github.com/code16/sharp/pull/748
- https://github.com/code16/sharp/commit/339f89110f36d06eaad3f2b4bd048fa5424e5558
- https://github.com/code16/sharp/releases/tag/v9.23.0
- https://github.com/code16/sharp/tree/v10.0.0-beta.4
- https://github.com/advisories/GHSA-g6f8-c3x9-jv7f