CVE-2024-51755: Twig Package Vulnerability Due to Unguarded Calls in Sandbox Mode
Summary
CVE-2024-51755: Twig has unguarded calls to __isset() and to array-accesses when the sandbox is enabled. Affects twig/twig across 2 version ranges.
< 3.11.2
>= 3.12, < 3.14.1
Fixed in 3.11.2 or 3.14.1, depending on the release line you run. How to fix ↓
Also tracked for
- php-twig · Debian:11
The same CVE-2024-51755 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Twig is a popular templating engine for PHP, widely used for its flexibility and ease of integration with various frameworks. It allows developers to create dynamic web pages by separating the presentation layer from the business logic. However, like any software, it can be susceptible to vulnerabilities that may compromise its security, particularly when operating in sandbox mode, which is designed to restrict access to certain features for safety.
Vulnerability Detail
The vulnerability arises from unguarded calls to the __isset() method and array-accesses when the sandbox mode is enabled. This oversight allows attackers to access attributes of array-like objects without proper security checks, potentially leading to unauthorized data exposure. The issue stems from the fact that the property policy did not adequately verify access permissions before allowing these operations, creating a significant security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.11.23.11.2composer require twig/twig:3.11.2 -
>= 3.12, < 3.14.13.14.1composer require twig/twig:3.14.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can avoid using sandbox mode until the package is updated. This will prevent the exploitation of the vulnerability, although it may limit some of the intended security features of Twig.
Conclusion
CVE-2024-51755 highlights a critical vulnerability in the Twig templating engine that can expose sensitive data when sandbox mode is enabled. It is crucial for developers to update to the latest patched versions to secure their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for twig/twig →
FAQ
CVE-2024-51755 is a vulnerability in the Twig templating engine that allows unauthorized access to array-like object attributes in sandbox mode.
If your application uses Twig in sandbox mode, it may be at risk of unauthorized data exposure, which could lead to security breaches.
Versions of Twig prior to 3.11.2 and 3.14.1 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your composer.lock file, you can receive real-time alerts about vulnerabilities, including CVE-2024-51755.
Yes, you can temporarily disable sandbox mode in your application to prevent exploitation until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for twig/twig.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
