Description
### Impact
An authenticated attacker can instantiate any class in the PHP application by using the `embed_key` parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the `__construct()` method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.
### Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that `embed_key` is a class extending `SharpFormEditorEmbed` before any instantiation.
### Workarounds
No known workarounds.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | code16/sharp | < 9.23.0 | 9.23.0 | GHSA-h24v-f482-8cwf |
| Packagist | code16/sharp | >= 10.0.0-beta.1, < 10.0.0-beta.4 | 10.0.0-beta.4 | GHSA-h24v-f482-8cwf |
References
- https://github.com/code16/sharp/security/advisories/GHSA-h24v-f482-8cwf web
- https://github.com/code16/sharp/pull/750 web
- https://github.com/code16/sharp/commit/dfafb44b11574e621bf0785f02c32b9866ab9923 web
- https://github.com/code16/sharp package
- https://github.com/code16/sharp/releases/tag/v9.23.0 web
- https://github.com/code16/sharp/tree/v10.0.0-beta.4 web