CVE-2022-29221: PHP Code Injection in Smarty
Summary
CVE-2022-29221: PHP Code Injection by malicious block or filename in Smarty. Affects smarty/smarty across 2 version ranges.
< 3.1.45
>= 4.0.0, < 4.1.1
Fixed in 3.1.45 or 4.1.1, depending on the release line you run. How to fix ↓
Also tracked for
- smarty3 · Debian:11
The same CVE-2022-29221 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Smarty is a popular template engine for PHP that allows separation of presentation and application logic. It is widely used in web development to generate dynamic web pages. However, a vulnerability has been discovered in Smarty that allows template authors to inject PHP code by using malicious block names or include file names. This vulnerability can be exploited by attackers to execute arbitrary code on the server, potentially leading to remote code execution and unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability in Smarty arises from a lack of proper input validation and sanitization when processing block names and include file names. Template authors can craft malicious names that include PHP code, which is then executed by the server when the template is rendered. This allows an attacker to execute arbitrary PHP code within the context of the application, potentially leading to a complete compromise of the server. Sites that cannot fully trust template authors are particularly vulnerable to this issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.453.1.45composer require smarty/smarty:3.1.45 -
>= 4.0.0, < 4.1.14.1.1composer require smarty/smarty:4.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there is no known workaround to mitigate this vulnerability without upgrading to the fixed versions of Smarty. It is strongly recommended to apply the necessary updates to ensure the security of your application.
Conclusion
The PHP Code Injection vulnerability in Smarty can have severe consequences, allowing attackers to execute arbitrary code on the server. To mitigate this risk, it is crucial to upgrade to the latest fixed versions of Smarty (v3.1.45 or v4.1.1). Failure to address this vulnerability may result in unauthorized access to sensitive data and compromise of the server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for smarty/smarty →
FAQ
Smarty is a template engine for PHP that separates the presentation and application logic in web development.
The vulnerability allows template authors to inject PHP code, potentially leading to remote code execution and unauthorized access to sensitive data.
You can fix this vulnerability by upgrading to the latest version of Smarty (v3.1.45 or v4.1.1).
Currently, there are no known workarounds for this vulnerability.
For more information, you can visit the Smarty GitHub repository or open an issue in the repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for smarty/smarty.
