Published: 04/02/2022 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

Vulnerable Product	Search on Vulmon	Subscribe to Product
symfony twig
fedoraproject fedora 34
fedoraproject fedora 35
debian debian linux 11.0

Marlon Starkloff discovered that twig, a template engine for PHP, did not correctly enforce sandboxing This would allow a malicious user to execute arbitrary code For the stable distribution (bullseye), this problem has been fixed in version 2143-1+deb11u1 We recommend that you upgrade your php-twig packages For the detailed security status o ...

PoC for CVE-2022-23614 (Twig sort filter code execution/sandbox bypass)

CVE-2022-23614 PoC for CVE-2022-23614, GHSA-5mv2-rx3q-4w2v (Twig sort filter code execution/sandbox bypass) As seen in this commit - githubcom/twigphp/Twig/commit/, twig was passing user supplied function name as a callback parameter to uasort (here), thus leading to arbitrary code execution To build and run the docker container with a vulnerable twig version $ /bu

Proof of concept for CVE-2022-23614 (command injection in Twig)

CVE-2022-23614 Proof of concept (PoC) for CVE-2022-23614 referenced in the DSA-5107-1 CVSS-20: 75 CVSS-3X: 98 Explanation Twig is a flexible, fast, and secure template engine for PHP Notably, it is possible to use filters in a template before rendering it The sort filter can be used to sort the elements of an array with the following structure: {{ [5,8,2,3]|sort('

CWE-94 https://github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5 https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9 https://github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2v https://www.debian.org/security/2022/dsa-5107 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OTN4273U4RHVIXED64T7DSMJ3VYTPRE7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PECHIY2XLWUH2WLCNPDGNFMPHPRPCEDZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2PVV5DUTRUECTIHMTWRI5Z7DVNYQ2YO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIGZCFSYLPP7UVJ4E4NLHSOQSKYNXSAD/https://nvd.nist.gov https://www.debian.org/security/2022/dsa-5107 https://github.com/davwwwx/CVE-2022-23614

CVE-2022-23614

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect