GHSA-h24v-f482-8cwfMediumCVSS 5.4
code16/sharp: Arbitrary class instantiation through the embed_key API parameter
🔗 CVE IDs covered (1)
📋 Description
Impact
An authenticated attacker can instantiate any class in the PHP application by using the embed_key parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the __construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.
Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that embed_key is a class extending SharpFormEditorEmbed before any instantiation.
Workarounds
No known workarounds.
🎯 Affected products2
- composer/code16/sharp:< 9.23.0
- composer/code16/sharp:>= 10.0.0-beta.1, < 10.0.0-beta.4
🔗 References (6)
- https://github.com/code16/sharp/security/advisories/GHSA-h24v-f482-8cwf
- https://github.com/code16/sharp/pull/750
- https://github.com/code16/sharp/commit/dfafb44b11574e621bf0785f02c32b9866ab9923
- https://github.com/code16/sharp/releases/tag/v9.23.0
- https://github.com/code16/sharp/tree/v10.0.0-beta.4
- https://github.com/advisories/GHSA-h24v-f482-8cwf