GitHub Advisoryadvisory · Packagist
GHSA-jjxq-ff2g-95vh Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
LOW
Official page ↗
- Aliases
- CVE-2024-51755
- Ecosystem
- Packagist
- Packages
- twig/twig
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-668
- Reviewed
- 2024-11-06
Affected packages
• Packagist twig/twig: < 3.11.2 → fixed in 3.11.2
• Packagist twig/twig: >= 3.12, < 3.14.1 → fixed in 3.14.1
Description
Description
In a sandbox, and attacker can access attributes of Array-like objects as they were not checked by the security policy.
They are now checked via the property policy and the `__isset()` method is now called after the security check.
This is a BC break.
Resolution
The sandbox mode now ensures access to array-like's properties is allowed.
The patch for this issue is available here for the 3.11.x branch, and here for the 3.x branch.
Credits
We would like to thank Jamie Schouten for reporting the issue and Nicolas Grekas for providing the fix.
Related
Alias · CVE (1)
- CVE-2024-51755 Twig is a template language for PHP. vulnerability
Weakness · CWE (1)
- CWE-668 Exposure of Resource to Wrong Sphere weakness
References
- https://github.com/twigphp/Twig/security/advisories/GHSA-jjxq-ff2g-95vh web
- https://nvd.nist.gov/vuln/detail/CVE-2024-51755 advisory
- https://github.com/twigphp/Twig/commit/831c148e786178e5f2fde9db67266be3bf241c21 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-51755.yaml web
- https://github.com/twigphp/Twig package
- https://symfony.com/blog/unguarded-calls-to-__isset-and-to-array-accesses-when-the-sandbox-is-enabled web