PT-2022-24853 · Twig+4 · Twig+4

Fabien Potencier + 3 · Published 2022-09-28 · Updated 2024-04-04 · CVE-2022-39261

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Twig versions 1.x prior to 1.44.7 Twig versions 2.x prior to 2.15.3 Twig versions 3.x prior to 3.4.3

Description The issue arises when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed.

Recommendations For versions 1.x prior to 1.44.7, update to version 1.44.7 or later. For versions 2.x prior to 2.15.3, update to version 2.15.3 or later. For versions 3.x prior to 3.4.3, update to version 3.4.3 or later. As a temporary workaround, consider restricting the use of the source and include statements with user-input template names until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2023-6184

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

BIT-DRUPAL-2022-39261

CVE-2022-39261

DLA-3147-1

DRUPAL-CORE-2022-016

DSA-5248-1

GHSA-52M2-VC4M-JJ33

USN-5947-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Twig

Ubuntu

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39261.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml · Exploit
• https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b · Patch
• https://osv.dev/vulnerability/GHSA-52m2-vc4m-jj33 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39261 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39261 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-39261 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2022-39261 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD · Vendor Advisory
• https://debian.org/security/2022/dsa-5248 · Vendor Advisory