Twig Sandbox Policy Bypass Vulnerability Allowing Unauthorized String Coercion

A vulnerability in Twig, a PHP template language, prior to version 3.27.0, allows for unauthorized coercion of Stringable objects to strings within the sandbox environment. This issue arises because the sandbox's __toString() checks do not adequately cover Traversable values used in join and replace filters, or in conjunction with the in and not in operators. As a result, Stringable objects can be converted to strings without adhering to the established sandbox policy, potentially leading to unintended consequences.

Impact

Exploitation of this vulnerability bypasses the sandbox's __toString() policy, allowing for unauthorized string coercion of objects accessible from the render context. This can be exploited to invoke disallowed __toString() methods on these objects, even if such methods are not included in the security policy's allowedMethods list. Additionally, when using the in operator with an attacker-chosen Stringable object, the vulnerability can leak information bit by bit, potentially reconstructing the object's __toString() output.

Reproduction

The vulnerability can be reproduced by creating a sandboxed Twig template that uses the join or replace filters with a Traversable object containing Stringable elements. Alternatively, the in or not in operators can be used with a Stringable object, which will be coerced to a string without consulting the sandbox policy, bypassing the intended security measures.

Remediation

Users can upgrade to Twig version 3.27.0 or later, where this vulnerability has been fixed.