Headline
GHSA-6j75-5wfj-gh66: Twig has a possible sandbox bypass
Description
Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.
The security issue happens when all these conditions are met:
- The sandbox is disabled globally;
- The sandbox is enabled via a sandboxed
include()
function which references a template name (likeincluded.twig
) and not aTemplate
orTemplateWrapper
instance; - The included template has been loaded before the
include()
call but in a non-sandbox context (possible as the sandbox has been globally disabled).
Resolution
The patch ensures that the sandbox security checks are always run at runtime.
Credits
We would like to thank Fabien Potencier for reporting and fixing the issue.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-45411
Twig has a possible sandbox bypass
High severity GitHub Reviewed Published Sep 9, 2024 in twigphp/Twig • Updated Sep 9, 2024
Package
Affected versions
>= 1.0.0, < 1.44.8
>= 2.0.0, < 2.16.1
>= 3.0.0, < 3.14.0
Patched versions
1.44.8
2.16.1
3.14.0
Description
Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.
The security issue happens when all these conditions are met:
- The sandbox is disabled globally;
- The sandbox is enabled via a sandboxed include() function which references a template name (like included.twig) and not a Template or TemplateWrapper instance;
- The included template has been loaded before the include() call but in a non-sandbox context (possible as the sandbox has been globally disabled).
Resolution
The patch ensures that the sandbox security checks are always run at runtime.
Credits
We would like to thank Fabien Potencier for reporting and fixing the issue.
References
- GHSA-6j75-5wfj-gh66
- twigphp/Twig@11f68e2
- twigphp/Twig@2102dd1
- twigphp/Twig@7afa198
Published to the GitHub Advisory Database
Sep 9, 2024
Related news
Debian Linux Security Advisory 5771-1 - Fabien Potencier discovered that under some conditions the sandbox mechanism of Twig, a template engine for PHP, could by bypassed.