CVE-2023-41336: symfony/ux-autocomplete Prevent injection of invalid entity ids for "autocomplete" fields

Affected Versions

Versions < 2.11.1 are of the symfony/ux-autocomplete package are affected by this security issue.

Description

Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices.

Affected applications are any that use:

• A custom query_builder option to limit the valid results;

AND

• An EntityType with 'autocomplete' => true or a custom AsEntityAutocompleteField.

Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with query_builder.

Resolution

The AutocompleteEntityTypeSubscriber now uses the query_builder if set as the base for the query made to find the selected id or ids.

The patch for this issue is available here.

Credits

We would like to thank Jan Klan and the Cognetiq security team for reporting the issue and Ryan Weaver for fixing it.