Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-634x-pc3q-cf4c: PHP Code Injection by malicious block or filename

Impact

Template authors could inject php code by choosing a malicous {block} name or {include} file name. Sites that cannot fully trust template authors should update asap.

Patches

Please upgrade to the most recent version of Smarty v3 or v4.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

ghsa
#vulnerability#git#php#auth#sap

Package

composer smarty/smarty (Composer )

Affected versions

< 3.1.45

>= 4.0.0, < 4.1.1

Patched versions

3.1.45

4.1.1

Description

Impact

Template authors could inject php code by choosing a malicous {block} name or {include} file name. Sites that cannot fully trust template authors should update asap.

Patches

Please upgrade to the most recent version of Smarty v3 or v4.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

  • Open an issue in the Smarty repo

References

  • GHSA-634x-pc3q-cf4c
  • https://nvd.nist.gov/vuln/detail/CVE-2022-29221
  • smarty-php/smarty@64ad644
  • https://github.com/smarty-php/smarty/releases/tag/v3.1.45
  • https://github.com/smarty-php/smarty/releases/tag/v4.1.1

wisskid published the maintainer security advisory

May 17, 2022

Severity

High

8.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

CVE ID

CVE-2022-29221

GHSA ID

GHSA-634x-pc3q-cf4c

Source code

smarty-php/smarty

Credits

  • altm4n

Improvements are not currently accepted on this advisory because it uses an unsupported versioning operator. Read more and discuss here.

Related news

Ubuntu Security Notice USN-6550-1

Ubuntu Security Notice 6550-1 - It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. It was discovered that Moment.js, that is integrated in the PostfixAdmin code, was using an inefficient parsing algorithm when processing date strings in the RFC 2822 standard. An attacker could possibly use this issue to cause a denial of service.

Ubuntu Security Notice USN-6012-1

Ubuntu Security Notice 6012-1 - It was discovered that Smarty incorrectly parsed blocks' names and included files' names. A remote attacker with template writing permissions could use this issue to execute arbitrary PHP code.

Gentoo Linux Security Advisory 202209-09

Gentoo Linux Security Advisory 202209-9 - Multiple vulnerabilities have been found in Smarty, the worst of which could result in remote code execution. Versions less than 4.2.1 are affected.

CVE-2022-29221: Release v3.1.45 · smarty-php/smarty

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.

CVE-2021-26119: smarty/CHANGELOG.md at master · smarty-php/smarty

Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.