CVE-2022-23614: Code injection in Twig
Description
When in a sandbox mode, the arrow parameter of the sort filter must be a closure to avoid attackers being able to run arbitrary PHP functions.
Resolution
We now disallow calling non Closure in the sort filter like we already did for some other filters.
Credits
We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.
Other sources
Disallow non closures in the sort filter
Twig is an open source template language for PHP. When in a sandbox mode, the arrow parameter of the sort filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the sort filter as is the case for some other filters. Users are advised to upgrade.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-23614.
What is the title of this vulnerability?
The title of this vulnerability is "Disallow non closures in the sort filter".
What is the affected software?
The affected software is Twig.
What versions of Twig are affected?
Twig versions 2.0.0 to 2.14.11 and 3.0.0 to 3.3.8 are affected.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following link: [Twig Security Release](https://symfony.com/blog/twig-security-release-disallow-non-closures-in-the-sort-filter)