PT-2023-27912 · Symfony · Symfony/Ux-Autocomplete

Janklan · Published 2023-09-11 · Updated 2023-09-15 · CVE-2023-41336

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions symfony/ux-autocomplete versions prior to 2.11.2

Description The issue allows an attacker to submit an entity id for an EntityType that is not part of the valid choices under certain circumstances. This can occur in applications that use a custom query builder option to limit valid results and an EntityType with 'autocomplete' => true or a custom AsEntityAutocompleteField. If an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with query builder.

Recommendations For versions prior to 2.11.2, upgrade to version 2.11.2 or greater of symfony/ux-autocomplete to fix the issue. Alternatively, perform extra validation after submit to verify the selected option is valid.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-41336

GHSA-4CPV-669C-R79X

Affected Products

Symfony/Ux-Autocomplete

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41336.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yaml · Exploit
• https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770c · Patch
• https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41336 · Security Note
• https://osv.dev/vulnerability/GHSA-4cpv-669c-r79x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41336 · Vendor Advisory
• https://github.com/symfony/ux-autocomplete · Note
• https://twitter.com/ulumuddin_cy/status/1701301971603562880 · Twitter Post
• https://twitter.com/CVEnew/status/1701319205025382828 · Twitter Post
• https://twitter.com/symfony/status/1701219650736984346 · Twitter Post
• https://twitter.com/phpinthenews/status/1701295728977395724 · Twitter Post
• https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax · Note