In short
- CVE-2023-37473 is a HIGH (CVSS 8.8) vulnerability affecting zenstruck/collection, collection (zenstruck).
- Chance of exploitation in the next 30 days (EPSS): 0.94%, higher than 61.2% of all vulnerabilities.
- Fix: update to 0.2.1 or later.
Description
Impact
Passing callable strings (ie system) caused the function to be executed.
Patches
Fixed in v0.2.1.
Workarounds
Do not allow passing user strings to EntityRepository::find() or query().
References
Fix commit.
NVD description
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free