code16/sharp: Arbitrary class instantiation through the embed_key API parameter

Impact

An authenticated attacker can instantiate any class in the PHP application by using the embed_key parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the __construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.

Patches

The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that embed_key is a class extending SharpFormEditorEmbed before any instantiation.

Workarounds

No known workarounds.