CVE-2024-51754: Unguarded calls to __toString() when nesting an object into an array
Description
In a sandbox, an attacker can call toString() on an object even if the toString() method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance).
Resolution
The sandbox mode now checks the toString() method call on all objects.
The patch for this issue is available here for the 3.11.x branch, and here for the 3.x branch.
Credits
We would like to thank Jamie Schouten for reporting the issue and Fabien Potencier for providing the fix.
Other sources
Twig is a template language for PHP. In a sandbox, an attacker can call toString() on an object even if the toString() method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
— Debian
Unguarded calls to toString() when nesting an object into an array
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 3.14.1 - Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 3.11.2 - Upgrade
Upgrade
debian/php-twigto a version that resolves this vulnerability.Fixed in 3.5.1-1+deb12u3 - Upgrade
Upgrade
debian/php-twigto a version that resolves this vulnerability.Fixed in 3.14.2-1 - Upgrade
Upgrade
debian/php-twigto a version that resolves this vulnerability.Fixed in 3.5.1-1+deb12u3Fixed in 3.27.0-0+deb13u1Fixed in 3.30.0-1 - Upgrade
Upgrade
Twigto a version that resolves this vulnerability.Fixed in 3.11.2 - Upgrade
Upgrade
Twigto a version that resolves this vulnerability.Fixed in 3.14.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51754?
The severity of CVE-2024-51754 is classified as medium, indicating potential risk to affected applications.
How do I fix CVE-2024-51754?
To fix CVE-2024-51754, update the twig/twig package to version 3.14.1 or 3.11.2 as per the resolution guidelines.
Which versions of twig/twig are affected by CVE-2024-51754?
CVE-2024-51754 affects twig/twig versions between 3.12.0 and 3.14.1, as well as all versions below 3.11.2.
Can CVE-2024-51754 be exploited in a sandbox environment?
Yes, CVE-2024-51754 can be exploited in a sandbox environment where an attacker can call the __toString() method on an object.
What is the nature of the vulnerability in CVE-2024-51754?
CVE-2024-51754 is a vulnerability that allows an attacker to bypass security policies related to the __toString() method in specific contexts.