Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri() to validate only the initial remote URL against trusteduri when a security policy was active. For resources handled by filegetcontents(), including HTTPS URLs, PHP followed HTTP redirects by default. An attacker who could supply or influence a fetch target and had an open redirect on a trusted host could redirect the request to an attacker-chosen internal endpoint, bypass the trusteduri allowlist, and perform server-side request forgery. This issue is fixed in versions 4.5.7 and 5.8.2.

smarty/smarty version 5.8.0 can read local files through PHP stream wrappers even when Smarty Security is enabled and all streams are disabled with Security::$streams = null.

The bypass uses Smarty's built-in stream: resource type. A template such as:

smarty {include file="stream:php://filter/read=convert.base64-encode/resource=/tmp/secret.tpl"}

is handled as Smarty resource type stream, so the security check that would normally reject the underlying php wrapper is not applied. StreamPlugin then opens the nested php://filter/... URI directly.

For comparison, the direct resource:

smarty {include file="php://filter/read=convert.base64-encode/resource=/tmp/secret.tpl"}

is blocked with stream 'php' not allowed by security setting.

Affected package:

- Ecosystem: Packagist / Composer - Package: smarty/smarty - Confirmed affected version: 5.8.0 - Confirmed source reference from Composer lock: 78d259d3b971c59a0cd719c270cc5cbb740c36a7 - Current stable version on Packagist at review time: v5.8.0 - Packagist usage at review time: 41,113,855 total downloads and 840,604 monthly downloads

Relevant code paths:

- Smarty\Resource\BasePlugin::load(...) - Smarty\Resource\StreamPlugin::getContent(...) - Smarty\Security::isTrustedStream(...)

BasePlugin::load() maps the built-in resource name stream directly to StreamPlugin before the code path that checks PHP stream wrappers with streamgetwrappers() and Security::isTrustedStream($type). StreamPlugin::getContent() later calls fopen($filepath, 'r+') on the nested URI when the resource name contains ://.

Preconditions:

An application must render templates that are not fully trusted while relying on Smarty Security to restrict local files and PHP stream wrappers. The PoC sets:

php $smarty->enableSecurity(); $smarty->securitypolicy->streams = null;

Local reproduction:

The PoC creates a disposable template directory and a separate outside directory. It enables Smarty Security, disables all streams, and then compares three includes:

1. ../outside/secret.tpl to confirm the ordinary trusted-directory boundary is enforced. 2. php://filter/... to confirm direct PHP streams are blocked by Security::$streams = null. 3. stream:php://filter/... to show the built-in stream: resource bypasses the same restriction and reads the outside file.

Run:

shell php -d displayerrors=1 poc.php

Observed sanitized output:

text package=smarty/smarty installedversion=v5.8.0 templatedir=<tmp>/templates outsidetemplate=<tmp>/outside/secret.tpl plaindotdotinclude=BLOCKED:Smarty\Exception:Smarty Security: not trusted file path '<tmp>/outside/secret.tpl' directphpfilterinclude=BLOCKED:Smarty\Exception:stream 'php' not allowed by security setting streamphpfilterinclude=OK:U01BUlRZX1NUUkVBTV9XUkFQUEVSX1NFQ1VSSVRZX0VTQ0FQRQ== expectedbase64=U01BUlRZX1NUUkVBTV9XUkFQUEVSX1NFQ1VSSVRZX0VTQ0FQRQ==

The plaindotdotinclude line shows the directory boundary is enforced for ordinary traversal. The directphpfilterinclude line shows the same policy rejects php://filter when used directly. The streamphpfilterinclude line shows that wrapping the same URI in Smarty's stream: resource bypasses that restriction and reads the outside file.

Impact:

A template author can bypass Smarty Security stream restrictions and read local files that are readable by the PHP process. With php://filter, file contents can be base64 encoded and rendered back through the template. This bypasses both the intended Security::$streams = null restriction and the normal trusted-template-directory check that blocks ../ traversal.

Duplicate checks:

- OSV query for Packagist/smarty/smarty version 5.8.0 returned no vulnerabilities. - GitHub advisory query for ecosystem=composer and affects=smarty/smarty returned historical Smarty advisories, including sandbox escapes, PHP code injection, XSS, and older path traversal issues. The listed path traversal advisories affect older versions and do not describe this current stream:php://filter resource-wrapper bypass in 5.8.0. - GitHub issue search in smarty-php/smarty for stream:php://filter returned zero results. - Public searches for Smarty StreamPlugin php://filter and smarty/smarty isTrustedStream stream: did not identify a clear public duplicate during triage.

Suggested remediation:

When resolving the built-in stream: resource, parse and validate the nested URI scheme before opening it. For example, stream:php://filter/... should call Security::isTrustedStream('php'), and Security::$streams = null should block the resource before StreamPlugin::getContent() reaches fopen().

It would also be safer for StreamPlugin to reject nested stream wrappers by default unless the underlying wrapper is explicitly allowed by the active security policy.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.

Impact An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user.

Patches Please upgrade to the most recent version of Smarty v3 or v4.

For more information If you have any questions or comments about this advisory please open an issue in the Smarty repo

In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smartyfunctionmailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.

Last updated 24 July 2024

Impact Template authors could run restricted static php methods.

Patches Please upgrade to 3.1.40 or higher.

References See the documentation on Smarty security features on the staticclasses access filter.

For more information If you have any questions or comments about this advisory please open an issue in the Smarty repo

Impact Template authors could run arbitrary PHP code by crafting a malicious math string. If a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.

Patches Please upgrade to 4.0.2 or 3.1.42 or higher.

References See documentation on Math function.

For more information If you have any questions or comments about this advisory please open an issue in the Smarty repo

Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.

Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on Smarty Security features should upgrade as soon as possible. Please upgrade to 3.1.39 or higher.

The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smartyinternalcompileprivatespecialvariable.php file.

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusteddir protection mechanism via a file:./../ substring in an include statement.

SmartySecurity::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.

Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.

Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.

Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.

Cross-site scripting (XSS) vulnerability in the smartyfunctionhtmloptionsoptoutput function in distribution/libs/plugins/function.htmloptions.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Please use CVE-2011-1028.

Thanks.

-- JB

----- Original Message ----- Hello Josh, Steve, vendors,

Smarty upstream has released v3.0.7 on 11-th of February 2011: [1] http://groups.google.com/group/smarty-announce/browsethread/thread/18af294596756ac8

addressing one security flaw: [2] http://www.smarty.net/forums/viewtopic.php?t=18815 [3] http://smarty-php.googlecode.com/svn/trunk/distribution/changelog.txt [4] http://secunia.com/advisories/43284/

Not sure this one got a CVE identifier already. If not, could you allocate one?

Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team

Smarty before 3.0.0 beta 7 does not properly handle the <?php and ?> tags, which has unspecified impact and remote attack vectors.

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors.

Smarty before 3.0.0, when security is enabled, does not prevent access to the (1) dynamic and (2) private object members of an assigned object, which has unspecified impact and remote attack vectors.

Smarty before 3.0.0 RC3 does not properly handle an on value of the asptags option in the php.ini file, which has unspecified impact and remote attack vectors.

Multiple unspecified vulnerabilities in the parser implementation in Smarty before 3.0.0 RC3 have unknown impact and remote attack vectors.

Unspecified vulnerability in the math plugin in Smarty before 3.0.0 RC1 has unknown impact and remote attack vectors. NOTE: this might overlap CVE-2009-1669.

Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file.

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

Multiple unspecified vulnerabilities in Smarty before 3.0.0 beta 6 have unknown impact and attack vectors.

The smartyfunctionmath function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information.

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to templates and a \ (backslash) before a dollar-sign character.

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and (1) a dollar-sign character, aka "php executed in templates;" and (2) a double quoted literal string, aka a "function injection security hole." NOTE: each vector affects slightly different SVN revisions.