symfony/ux-autocomplete: XSS via unescaped AJAX response data
The advisory, in context
Description
The Stimulus controller shipped with symfony/ux-autocomplete renders AJAX response items into the dropdown by interpolating the text field directly into HTML template literals (<div>${item[labelField]}</div>) inside _createAutocompleteWithRemoteData(). The value is parsed as HTML rather than text, so any markup contained in the AJAX response is executed by the browser.
When the dropdown values are derived from user-supplied content, an attacker can craft a string that triggers stored XSS in the browser of any other user who later opens a page containing an autocomplete widget backed by the same data.
Resolution
The option and item renderers used in _createAutocompleteWithRemoteData() now use TomSelect's escape helper to HTML-escape the value by default. Endpoints that legitimately return HTML (for example, to highlight the search term) can opt back in to the previous behavior by setting options_as_html: true. The AutocompleteChoiceTypeExtension normalizer that previously forced options_as_html=false when autocomplete_url was set has been dropped so the opt-in is reachable from the form layer.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Credits
Symfony would like to thank Alex Ashkov for reporting the issue and Hugo Alliaume for providing the fix.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.2.0 before 2.36.0
Fixed in 2.36.0
53 explicitly affected versions
v2.10.0, v2.11.0, v2.11.1, v2.11.2, v2.12.0, v2.13.0, v2.13.1, v2.13.2, v2.13.3, v2.14.0, v2.14.2, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.19.0, v2.19.2, v2.2.0, v2.20.0, v2.21.0, v2.22.0, v2.22.1, v2.23.0, v2.24.0, v2.25.0, v2.25.1, v2.25.2, v2.26.0, v2.26.1, v2.27.0, v2.28.0, v2.28.1, v2.28.2, v2.29.0, v2.29.1, v2.29.2, v2.3.0, v2.30.0, v2.31.0, v2.32.0, v2.33.0, v2.34.0, v2.35.0, v2.4.0, v2.5.0, v2.6.0, v2.6.1, v2.7.0, v2.7.1, v2.8.0, v2.8.1, v2.9.0, v2.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.36.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.10.0",
"v2.11.0",
"v2.11.1",
"v2.11.2",
"v2.12.0",
"v2.13.0",
"v2.13.1",
"v2.13.2",
"v2.13.3",
"v2.14.0",
"v2.14.2",
"v2.15.0",
"v2.16.0",
"v2.17.0",
"v2.18.0",
"v2.19.0",
"v2.19.2",
"v2.2.0",
"v2.20.0",
"v2.21.0",
"v2.22.0",
"v2.22.1",
"v2.23.0",
"v2.24.0",
"v2.25.0",
"v2.25.1",
"v2.25.2",
"v2.26.0",
"v2.26.1",
"v2.27.0",
"v2.28.0",
"v2.28.1",
"v2.28.2",
"v2.29.0",
"v2.29.1",
"v2.29.2",
"v2.3.0",
"v2.30.0",
"v2.31.0",
"v2.32.0",
"v2.33.0",
"v2.34.0",
"v2.35.0",
"v2.4.0",
"v2.5.0",
"v2.6.0",
"v2.6.1",
"v2.7.0",
"v2.7.1",
"v2.8.0",
"v2.8.1",
"v2.9.0",
"v2.9.1"
]
}From 3.0.0 before 3.1.0
Fixed in 3.1.0
1 explicitly affected versions
v3.0.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0"
]
}