Executive brief
A vulnerability in the PHP library used to interact with Canto SaaS allows attackers to redirect authenticated requests to unintended API endpoints. This occurs when the library processes unvalidated user input, potentially allowing unauthorized reading or writing of data within the Canto platform. The impact depends on how the application using this library handles user-provided IDs and parameters.
Technical details
The vulnerability exists in the `Request::buildRequestUrl()` method of the `jleehr/canto-saas-api` library, which constructs request URLs by imploding path variables without proper URL encoding. An attacker can provide malicious input containing characters like `../`, `?`, or `#` to manipulate the final API request path. Because the library automatically attaches Bearer access tokens in `AbstractEndpoint::sendRequest()`, these redirected requests are executed with the full privileges of the configured application. This can lead to Server-Side Request Forgery (SSRF) targeting other endpoints within the same Canto instance. The issue is fixed in version 3.0.0 by applying `rawurlencode()` to all path segments.
Affected products
- jleehr canto-saas-api <= 2.0.0
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory: GitHub Advisory published