{"id":"GHSA-5mv2-rx3q-4w2v","aliases":["CVE-2022-23614"],"title":"Code injection in Twig","description":"# Description\n\nWhen in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions.\n\n# Resolution\n\nWe now disallow calling non Closure in the `sort` filter like we already did for some other filters.\n\n# Credits\n\nWe would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.\n ","severity":"high","score":8.8,"published":"2022-02-10T22:21:48.000Z","modified":"2024-02-16T08:18:54.981Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"twig/twig","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.14.11"}],"type":"ECOSYSTEM"}],"versions":["v2.0.0","v2.1.0","v2.10.0","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.12.1","v2.12.2","v2.12.3","v2.12.4","v2.12.5","v2.13.0","v2.13.1","v2.14.0","v2.14.1","v2.14.10","v2.14.2","v2.14.3","v2.14.4","v2.14.5","v2.14.6","v2.14.7","v2.14.8","v2.14.9","v2.2.0","v2.3.0","v2.3.1","v2.3.2","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.5.0","v2.6.0","v2.6.1","v2.6.2","v2.7.0","v2.7.1","v2.7.2","v2.7.3","v2.7.4","v2.8.0","v2.8.1","v2.9.0"],"fixed":["2.14.11"]},{"ecosystem":"Packagist","name":"twig/twig","ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.3.8"}],"type":"ECOSYSTEM"}],"versions":["v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.1.0","v3.1.1","v3.2.1","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7"],"fixed":["3.3.8"]}],"references":["https://github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2v","https://nvd.nist.gov/vuln/detail/CVE-2022-23614","https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9","https://github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5","https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-23614.yaml","https://github.com/twigphp/Twig","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2PVV5DUTRUECTIHMTWRI5Z7DVNYQ2YO","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTN4273U4RHVIXED64T7DSMJ3VYTPRE7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PECHIY2XLWUH2WLCNPDGNFMPHPRPCEDZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIGZCFSYLPP7UVJ4E4NLHSOQSKYNXSAD","https://symfony.com/blog/twig-security-release-disallow-non-closures-in-the-sort-filter","https://www.debian.org/security/2022/dsa-5107"],"sources":[{"name":"OSV","id":"GHSA-5mv2-rx3q-4w2v","modified":"2024-02-16T08:18:54.981960Z","url":"https://osv.dev/vulnerability/GHSA-5mv2-rx3q-4w2v"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}]}