CVE-2024-45411: Possible sandbox bypass
Description
Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.
The security issue happens when all these conditions are met:
The sandbox is disabled globally; The sandbox is enabled via a sandboxed include() function which references a template name (like included.twig) and not a Template or TemplateWrapper instance; The included template has been loaded before the include() call but in a non-sandbox context (possible as the sandbox has been globally disabled).
Resolution
The patch ensures that the sandbox security checks are always run at runtime.
Credits
We would like to thank Fabien Potencier for reporting and fixing the issue.
Other sources
Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 3.11.1 - Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 3.14.0 - Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 2.16.1 - Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 1.44.8 - Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 1.44.7 - Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 2.16.0 - Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 3.11.0 - Upgrade
Upgrade
debian/php-twigto a version that resolves this vulnerability.Fixed in 3.5.1-1+deb12u1 - Upgrade
Upgrade
debian/php-twigto a version that resolves this vulnerability.Fixed in 3.8.0-4 - Upgrade
Upgrade
debian/php-twigto a version that resolves this vulnerability.Fixed in 3.5.1-1+deb12u3Fixed in 3.27.0-0+deb13u1Fixed in 3.30.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.44.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.16.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.14.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45411?
CVE-2024-45411 is considered a critical vulnerability due to its potential to allow bypassing of sandbox restrictions.
How do I fix CVE-2024-45411?
To fix CVE-2024-45411, update the Twig package to versions 1.44.8, 2.16.1, 3.11.1, or 3.14.0.
What are the affected versions for CVE-2024-45411?
CVE-2024-45411 affects Twig versions below 1.44.8, 2.16.1, 3.11.1, and 3.14.0.
What conditions lead to the CVE-2024-45411 vulnerability?
The vulnerability occurs when the sandbox is globally disabled and managed incorrectly, allowing user-contributed templates to bypass security checks.
Who is impacted by CVE-2024-45411?
Users of the Twig templating engine who have disabled sandbox security checks are at risk for CVE-2024-45411.