Twig Sandbox Policy Bypass Vulnerability in Column Filter

A vulnerability in Twig's column filter allows template authors to bypass sandbox restrictions and access disallowed public or magic properties. This issue affects Twig versions prior to 3.27.0 and arises when sandboxing is managed through the SourcePolicyInterface. The vulnerability exists because the column filter does not properly forward the current source to the sandbox extension, leading to a loss of policy enforcement. As a result, unauthorized property access is possible, creating a significant security risk.

Impact

Exploitation of this vulnerability allows for unauthorized access to public or magic properties of objects in the render context, bypassing the intended sandbox restrictions. This creates a policy enforcement gap, particularly for templates using the SourcePolicyInterface to manage sandboxing.

Reproduction

To reproduce this vulnerability, create a Twig template that uses the 'column' filter while sandboxing is enabled through a SourcePolicyInterface. The policy should allow the 'column' filter but not permit access to certain properties. When the template is rendered, the disallowed properties can be accessed, demonstrating the bypass.

Remediation

Users can upgrade to Twig version 3.27.0 or later, where this vulnerability has been fixed.