PT-2022-2575 · Twig+3 · Twig+3

Marlon Starkloff · Published 2022-02-04 · Updated 2024-04-04 · CVE-2022-23614

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Twig versions prior to the patched version

Description The issue arises from the lack of proper enforcement of the constraint that the arrow parameter of the sort filter must be a closure when in sandbox mode. This could lead to code injection of arbitrary PHP code, allowing attackers to run arbitrary PHP functions. The patched versions now disallow calling non-closure in the sort filter.

Recommendations For all affected versions of Twig, users are advised to upgrade to a patched version to resolve the issue. As a temporary workaround, consider disabling the sort filter until a patch is available. Restrict access to the arrow parameter of the sort filter to minimize the risk of exploitation. Avoid using the arrow parameter in the affected sort filter until the issue is resolved.

Exploit

Fix

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

ALT-PU-2023-6184

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

BDU:2022-03019

CVE-2022-23614

DSA-5107-1

GHSA-5MV2-RX3Q-4W2V

USN-5947-1

Affected Products

Linuxmint

Red Os

Twig

Ubuntu

References · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23614.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24894.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46734.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2022-24894.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/firebase/php-jwt/CVE-2021-46743.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-23614.yaml · Exploit
• 🔥 https://github.com/Nyamort/CVE-2024-50340 · Exploit
• 🔥 https://github.com/Acceis/exploit-CVE-2022-24780 · Exploit
• 🔥 https://github.com/davwwwx/CVE-2022-23614 · Exploit
• 🔥 https://github.com/IbrahimEkimIsik/CVE/blob/main/CVE-2022-31403 · Exploit
• 🔥 https://github.com/YavuzSahbaz/CVE-2022-31402/blob/main/iTop%203.0.1%20XSS%20Vulnerability · Exploit
• https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9 · Patch
• https://github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23614 · Vendor Advisory