CyberRota Analysis
AI-GeneratedThe canto-saas-api PHP library is vulnerable due to improper encoding of path segments in the Request::buildRequestUrl() method, allowing attackers to manipulate path variables and potentially perform unauthorized reads or writes within the application. This vulnerability primarily affects applications that accept untrusted input for path variables, making it critical for developers using versions prior to 3.0.0 to prioritize upgrading to mitigate the risk of exploitation. Organizations relying on this library should assess their input validation practices to ensure they are not susceptible to such attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When a consuming application supplies an untrusted path variable value, path traversal sequences, query delimiters, or fragment delimiters can change the destination endpoint before AbstractEndpoint::sendRequest() attaches the configured authentication token. An attacker who controls that path variable value through the consuming application can cause unintended reads or writes with the configured application's privileges on the same Canto instance, but applications that pass only trusted and validated identifiers are not exploitable. This issue is fixed in version 3.0.0.