Impact

Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices.

Affected applications are any that use:

• A custom query_builder option to limit the valid results;
  AND
• An EntityType with 'autocomplete' => true or a custom AsEntityAutocompleteField.

Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with query_builder.

Patches

The problem has been fixed in symfony/ux-autocomplete version 2.11.2.

Workarounds

Upgrade to version 2.11.2 or greater of symfony/ux-autocomplete or perform extra validation after submit to verify the selected option is valid.

References

• GHSA-4cpv-669c-r79x
• symfony/ux-autocomplete@fabcb2e
• https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yaml
• https://nvd.nist.gov/vuln/detail/CVE-2023-41336