Description
### Impact
An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.
### Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.
### Workarounds
Use `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | code16/sharp | < 9.23.0 | 9.23.0 | GHSA-g6f8-c3x9-jv7f |
| Packagist | code16/sharp | >= 10.0.0-beta.1, < 10.0.0-beta.4 | 10.0.0-beta.4 | GHSA-g6f8-c3x9-jv7f |
References
- https://github.com/code16/sharp/security/advisories/GHSA-g6f8-c3x9-jv7f web
- https://github.com/code16/sharp/pull/748 web
- https://github.com/code16/sharp/commit/339f89110f36d06eaad3f2b4bd048fa5424e5558 web
- https://github.com/code16/sharp package
- https://github.com/code16/sharp/releases/tag/v9.23.0 web
- https://github.com/code16/sharp/tree/v10.0.0-beta.4 web