Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the
    `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected
    versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code.
    Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other
    filters. Users are advised to upgrade. (CVE-2022-23614)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5947-1 advisory.

    Fabien Potencier discovered that Twig was not properly enforcing sandbox policies when dealing with     objects automatically cast to strings by PHP. An attacker could possibly use this issue to expose     sensitive information. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2019-9942)

    Marlon Starkloff discovered that Twig was not properly enforcing closure constraints in some of its array     filtering functions. An attacker could possibly use this issue to execute arbitrary code. This issue was     only fixed in Ubuntu 20.04 ESM. (CVE-2022-23614)

    Dariusz Tytko discovered that Twig was not properly verifying input data utilized when defining pathnames     used to access files in a system. An attacker could possibly use this issue to access unauthorized     resources and expose sensitive information. (CVE-2022-39261)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5107 advisory.

  - Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the     `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected     versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code.
    Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other     filters. Users are advised to upgrade. (CVE-2022-23614)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
410931	SCA: security update for twig/twig (GHSA-5mv2-rx3q-4w2v)	Tenable Cloud Security	SCA Checks	critical
410931	SCA: security update for twig/twig (GHSA-5mv2-rx3q-4w2v)	Tenable Self-Hosted Container Security	SCA Checks	critical
172497	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Twig vulnerabilities (USN-5947-1)	Nessus	Ubuntu Local Security Checks	critical
159202	Debian DSA-5107-1 : php-twig - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-23614

critical

Tenable Plugins

critical

critical

critical

critical