CVE-2017-1000480: Smarty PHP code injection in smarty/smarty
Summary
CVE-2017-1000480: Smarty PHP code injection. Affects smarty/smarty versions >= 3, < 3.1.32. Fixed in 3.1.32. How to fix ↓
Also tracked for
- smarty3 · Debian:11
The same CVE-2017-1000480 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Smarty is a popular PHP template engine used for separating presentation logic from application logic. It provides a simple and efficient way to generate dynamic web pages. The vulnerability identified as CVE-2017-1000480 affects Smarty versions prior to 3.1.32. This vulnerability allows for PHP code injection when calling the fetch() or display() functions on custom resources that do not properly sanitize the template name.
Vulnerability Detail
The vulnerability arises due to a lack of input sanitization in the fetch() and display() functions of Smarty. An attacker can exploit this vulnerability by providing a specially crafted template name, which can include arbitrary PHP code. When the template is fetched or displayed, the injected PHP code will be executed on the server, leading to potential remote code execution. This can result in unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
Minimum fixed version
3.1.32
This is the first release that contains the fix.
composer require smarty/smarty:3.1.32Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Smarty is not immediately feasible, a temporary workaround is to manually sanitize the template name before passing it to the fetch() or display() functions. This can be done by using appropriate input validation and sanitization techniques, such as whitelisting allowed characters and rejecting any input that contains potentially dangerous characters or sequences. Here is an example of how to sanitize the template name using PHP's filter_var() function:
$templateName = filter_var($templateName, FILTER_SANITIZE_STRING);
Conclusion
The vulnerability identified as CVE-2017-1000480 in Smarty versions prior to 3.1.32 allows for PHP code injection, potentially leading to remote code execution. To mitigate this vulnerability, it is crucial to upgrade to Smarty version 3.1.32 or later. If immediate upgrade is not possible, manual sanitization of the template name can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for smarty/smarty →
FAQ
Smarty is a PHP template engine that separates presentation logic from application logic. It provides a convenient way to generate dynamic web pages.
Smarty versions prior to 3.1.32 are vulnerable to this PHP code injection vulnerability.
This vulnerability allows for remote code execution, which can lead to unauthorized access, data leakage, or complete compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade to Smarty version 3.1.32 or later.
If upgrading to the latest version of Smarty is not immediately feasible, you can manually sanitize the template name before passing it to the fetch() or display() functions.
Related vulnerabilities
Recent vulnerabilities recorded for smarty/smarty.
