Twig Template Language Sandbox Bypass Vulnerability Allowing Security Policy Mismanagement

A vulnerability exists in Twig, a template language for PHP, prior to version 3.27.0, allowing a bypass of the sandbox security policy. The issue arises because the security allow-list for filters, tags, and functions is determined when a template is first loaded and can be cached. This cached information may not reflect subsequent changes in the sandbox state, leading to a situation where a template can be reused in a sandboxed context without the appropriate security checks. The vulnerability is particularly concerning in environments that share a single Twig environment between different requests, such as with PHP-FPM or certain message queue consumers.

Impact

Exploitation of this vulnerability allows templates to be rendered with outdated or incorrect security policies, potentially leading to unauthorized access to template features that should be restricted, such as certain filters or functions.

Reproduction

To reproduce this vulnerability, first load a template in a non-sandboxed context, which will cache the template instance without applying any security restrictions. Then, change the sandbox state to enabled and attempt to render the same template or one that extends it. The template will be rendered using the original, less restrictive security policy, bypassing the intended sandbox controls.

Remediation

Users can upgrade to Twig version 3.27.0 or later, where this vulnerability has been fixed.