CVE-2022-23614 — Code injection in Twig

Affected: twigphp Twig

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

USN-5947-1 — php-twig, twig vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: twig, Ubuntu:Pro:18.04:LTS: twig, Ubuntu:Pro:20.04:LTS: php-twig, Ubuntu:Pro:22.04:LTS: php-twig

Fabien Potencier discovered that Twig was not properly enforcing sandbox policies when dealing with objects automatically cast to strings by PHP. An attacker could possibly use this issue to expose sensitive information. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2019-9942)

Marlon Starkloff discovered that Twig was not properly enforcing closure constraints in some of its array filtering functions. An attacker could possibly use this issue to execute arbitrary code. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2022-23614)

Dariusz Tytko discovered that Twig was not properly verifying input data utilized when defining pathnames used to access files in a system. An attacker could possibly use this issue to access unauthorized resources and expose sensitive information. (CVE-2022-39261)

Most recent entries from all

CVE-2022-23614 — Code injection in Twig

USN-5947-1 — php-twig, twig vulnerabilities