GHSA-5mv2-rx3q-4w2v

Suggest an improvement
Source
https://github.com/advisories/GHSA-5mv2-rx3q-4w2v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-5mv2-rx3q-4w2v/GHSA-5mv2-rx3q-4w2v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5mv2-rx3q-4w2v
Aliases
Published
2022-02-10T22:21:48Z
Modified
2024-02-16T08:18:54.981960Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Code injection in Twig
Details

Description

When in a sandbox mode, the arrow parameter of the sort filter must be a closure to avoid attackers being able to run arbitrary PHP functions.

Resolution

We now disallow calling non Closure in the sort filter like we already did for some other filters.

Credits

We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.

Database specific 
{
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "nvd_published_at": "2022-02-04T23:15:00Z",
    "github_reviewed_at": "2022-02-07T16:43:09Z"
}
References

Affected packages

Packagist / twig/twig

Package

Name
twig/twig
Purl
pkg:composer/twig/twig

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.14.11

Affected versions

v2.*

v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.4.7
v2.4.8
v2.5.0
v2.6.0
v2.6.1
v2.6.2
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.8.0
v2.8.1
v2.9.0
v2.10.0
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.12.0
v2.12.1
v2.12.2
v2.12.3
v2.12.4
v2.12.5
v2.13.0
v2.13.1
v2.14.0
v2.14.1
v2.14.2
v2.14.3
v2.14.4
v2.14.5
v2.14.6
v2.14.7
v2.14.8
v2.14.9
v2.14.10

Packagist / twig/twig

Package

Name
twig/twig
Purl
pkg:composer/twig/twig

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.3.8

Affected versions

v3.*

v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.1.0
v3.1.1
v3.2.1
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7