PT-2018-12201 · Symfony · Twig

Bh-Eo · Publicado 2018-07-10 · Atualizado 2024-08-05 · CVE-2018-13818

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Twig versions prior to 2.4.4

Description The issue allows Server-Side Template Injection (SSTI) via the search key parameter. It is noted that Twig itself is not a web application, and the responsibility of properly wrapping input to it lies with web applications using Twig.

Recommendations For versions prior to 2.4.4, update to version 2.4.4 or later to resolve the issue. As a temporary workaround, consider properly wrapping input to Twig to prevent Server-Side Template Injection. Restrict access to the search key parameter in affected applications to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2018-13818

Produtos afetados

Twig

Referências · 11

• 🔥 https://github.com/twigphp/Twig/issues/2743 · Exploit
• 🔥 https://exploit-db.com/exploits/44102 · Exploit
• 🔥 https://mobile.twitter.com/jameel_nabbo/status/1032593354704515072?s=20 · Exploit
• https://github.com/twigphp/Twig/blob/2.x/CHANGELOG · Nota
• https://github.com/twigphp/Twig/commit/eddb97148ad779f27e670e1e3f19fb323aedafeb · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-13818 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-13818 · Aviso do Fabricante
• https://t.me/cvenotify/89153 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2018-13818 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-13818 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-13818 · Aviso do Fabricante