PT-2022-3224 · Smarty+2 · Smarty+2

Altm4N + 1 · Published 2022-05-17 · Updated 2023-12-12 · CVE-2022-29221

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 3.1.45 Smarty versions 4.0.0 through 4.1.0

Description The issue is related to incorrect code generation management in the PHP Smarty template engine, allowing a remote attacker to execute arbitrary PHP code. Template authors could inject PHP code by choosing a malicious {block} name or {include} file name. This affects sites that cannot fully trust template authors.

Recommendations For versions prior to 3.1.45, upgrade to version 3.1.45 to receive a patch for this issue. For versions 4.0.0 through 4.1.0, upgrade to version 4.1.1 to receive a patch for this issue. As a temporary workaround, consider restricting the ability of template authors to choose {block} names or {include} file names until a patch is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2022-03926

CVE-2022-29221

DLA-3033-1

DSA-5151-1

GHSA-634X-PC3Q-CF4C

MGASA-2022-0226

USN-6012-1

USN-6550-1

Affected Products

Linuxmint

Smarty

Ubuntu

References · 43

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29221.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2022-29221.yaml · Exploit
• 🔥 https://github.com/sbani/CVE-2022-29221-PoC · Exploit
• 🔥❌ https://github.com/Udyz/CVE-2021-26119 · Exploit, Deleted
• https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd · Patch
• https://osv.dev/vulnerability/USN-6550-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6550-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI · Vendor Advisory
• https://security.gentoo.org/glsa/202209-09 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI · Vendor Advisory
• https://debian.org/security/2022/dsa-5151 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6012-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/679500 · Security Note
• https://osv.dev/vulnerability/DSA-5151-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03926 · Security Note