Twig Sandbox Bypass Vulnerability in Deprecated Internal Wrappers

A vulnerability allowing sandbox bypass has been identified in Twig versions prior to 3.27.0. The issue arises in deprecated internal wrappers that do not properly forward the current sandbox state, allowing certain legacy calls to bypass sandbox restrictions. This vulnerability affects applications that use the deprecated 'twig_array_some()', 'twig_array_every()', and 'twig_check_arrow_in_sandbox()' functions within a sandboxed environment.

Impact

Exploitation of this vulnerability allows for bypassing sandbox restrictions, enabling the use of non-closure callables in sandboxed contexts, which could lead to unintended behavior or security issues.

Reproduction

The vulnerability can be reproduced by creating a sandboxed Twig environment and calling the deprecated 'twig_array_some()' or 'twig_array_every()' functions with a string callable, such as 'strcmp'. The absence of the expected sandbox enforcement will demonstrate the bypass. Additionally, 'twig_check_arrow_in_sandbox()' can be used to trigger a TypeError by passing an Environment object instead of a boolean, highlighting the mismatch caused by the vulnerability.

Remediation

Users can upgrade to Twig version 3.27.0 or later, where this vulnerability has been fixed.