Twig Path Traversal Vulnerability in Twig/Twig

Background

Twig is a popular templating engine for PHP that allows developers to create reusable templates for web applications. It is widely used in various PHP frameworks and applications. The Twig_Loader_Filesystem component is responsible for loading Twig templates from the filesystem. However, when non-trusted template names are used, a path traversal vulnerability can be exploited. This vulnerability allows an attacker to include files outside of the intended directory, potentially leading to unauthorized access or code execution.

Vulnerability Detail

The Twig path traversal vulnerability occurs when an application uses non-trusted template names in conjunction with the Twig_Loader_Filesystem component. By manipulating the template name, an attacker can navigate to parent directories and include files outside of the intended template directory. For example, by prepending the template name with "../", an attacker can include a file stored in a higher-level directory. It is important to note that only the "../" prefix is effective, and other variations will result in proper exceptions being thrown. This vulnerability can be exploited by an attacker with the ability to provide template names to the application.

composer require twig/twig:1.12.3

Workaround

If upgrading Twig is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing template names before passing them to the Twig_Loader_Filesystem component. This can be done by checking for any occurrences of the "../" prefix and rejecting template names that contain it. Here is an example of how this can be achieved in PHP:

$templateName = $_GET['template'];

if (strpos($templateName, '../') !== false) {
    throw new Exception('Invalid template name');
}

// Load the template using Twig
$loader = new Twig_Loader_Filesystem('/path/to/templates');
$twig = new Twig_Environment($loader);
$template = $twig->load($templateName);

// Render the template
echo $template->render();

Conclusion

The Twig path traversal vulnerability in Twig/Twig can allow an attacker to include files outside of the intended template directory, potentially leading to unauthorized access or code execution. It is crucial to upgrade Twig to version 1.12.3 or later to mitigate this vulnerability. Additionally, developers should validate and sanitize template names to prevent the inclusion of malicious or unauthorized files. For further assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for twig/twig →

FAQ