Log in Start free

Vulnerability · Published Feb 4, 2022 · Assigned by GitHub_M

CVE-2022-23614Code injection in Twig

High 8.8

In plain English

A high-severity injection in Twig from twigphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.2% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)8.2%top 5.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php-twig3.3.8-1DEBIAN-CVE-2022-23614
Debian:13php-twig3.3.8-1DEBIAN-CVE-2022-23614
Debian:14php-twig3.3.8-1DEBIAN-CVE-2022-23614
Packagisttwig/twig2.14.11GHSA-5mv2-rx3q-4w2v
Packagisttwig/twig3.3.8GHSA-5mv2-rx3q-4w2v

Affected products (as reported)

VendorProductVersions
twigphp Twig >= 3.0.0, < 3.3.8>= 2.0.0, < 2.14.11

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References