Twig Sandbox Policy Bypass Vulnerability via Dynamic Mapping Keys

A sandbox policy bypass vulnerability has been identified in Twig versions prior to 3.27.0. The issue arises in the ArrayExpression component, which fails to properly guard dynamic mapping keys that are converted to strings. This oversight allows PHP to directly invoke the __toString() method on Stringable objects used as mapping keys, bypassing the necessary sandbox checks. The vulnerability can be exploited by using a dynamic key expression that resolves to a Stringable object, such as a context variable, in an array mapping. This exploitation triggers the __toString() call without proper authorization, leading to a potential unauthorized disclosure of sensitive data.

Impact

Exploitation of this vulnerability can result in a sandbox policy bypass, allowing unauthorized access to data returned by the __toString() method of objects in the render context.

Reproduction

To reproduce this vulnerability, create a sandboxed Twig template and use a dynamic mapping key that resolves to a Stringable object, such as a context variable, in an array expression. The __toString() method will be invoked without the required sandbox authorization, demonstrating the policy bypass.

Remediation

Users can upgrade to Twig version 3.27.0 or later, where this vulnerability has been fixed.