CVE-2024-45411

Executive Summary

CVE-2024-45411 is a critical sandbox bypass vulnerability in the Twig template language for PHP. Under specific, unconfirmed circumstances, the sandbox security checks are not executed, allowing user-contributed templates to bypass restrictions and potentially execute arbitrary code or access sensitive data. The vulnerability affects all versions prior to 1.44.8, 2.16.1, and 3.14.0. With a CVSS score of 8.6, this vulnerability is considered high severity. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, due to the nature of the vulnerability and the widespread use of Twig, immediate patching is strongly recommended.

Supply Chain & Package Security

Twig is a widely used template engine in the PHP ecosystem, often installed via Composer. This vulnerability affects the core Twig library, which is a direct dependency for many PHP applications, including Symfony, Drupal, and Laravel (via Twig Bridge). Organizations using Twig should verify their dependency tree and ensure they are not pulling in a vulnerable version. The package is distributed via Packagist, and the fix is available in the specified versions. No malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - Complete information disclosure is possible.
• Integrity (I): High (H) - Total compromise of system integrity.
• Availability (A): High (H) - Total shutdown of the affected resource.

Threat Level: Critical. The combination of network exploitability, low complexity, and high impact makes this a top priority for patching.

Deep Dive & Mechanics

The vulnerability lies in the Twig sandbox extension, which is designed to restrict the functions, methods, and properties that can be accessed within a template. Under certain conditions, the sandbox checks are bypassed, allowing a template to call arbitrary PHP functions or access object properties that should be restricted.

The exact mechanism is not publicly disclosed, but it likely involves a flaw in how the sandbox evaluates template expressions, particularly when dealing with dynamic method calls, property accesses, or the use of special Twig tags/filters. An attacker who can control the content of a Twig template (e.g., through a template injection vulnerability or a feature that allows user-submitted templates) can craft a payload that evades the sandbox.

For example, a typical sandbox bypass might involve using the attribute() function or the _self variable to access internal Twig objects, or using PHP's __callStatic magic method to invoke arbitrary functions. The specific bypass in CVE-2024-45411 is likely a variation of these techniques.

Vulnerable vs. Patched Code

The patch addresses the sandbox bypass by ensuring that all template expressions are properly evaluated against the sandbox policy. The exact code changes are not publicly available, but the fix likely involves adding additional checks in the SandboxedNodeVisitor or SandboxedEnvironment classes.

Vulnerable Code (Conceptual):

// In a vulnerable version, the sandbox might not check certain node types.
public function enterNode(Node $node, Environment $env): Node
{
    // Missing check for some node types
    return $node;
}

Patched Code (Conceptual):

// In the patched version, all node types are checked.
public function enterNode(Node $node, Environment $env): Node
{
    if ($node instanceof SomeNodeType) {
        $this->checkSandbox($node, $env);
    }
    // Additional checks for other node types
    return $node;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A PHP application using a vulnerable version of Twig (e.g., 3.13.0).
• The application must allow user-contributed templates or have a template injection vulnerability.
• The Twig sandbox must be enabled.

Exploitation Steps:

1. Identify a template injection point or a feature that accepts user template code.
2. Craft a payload that bypasses the sandbox. Since no public PoC exists, this requires reverse engineering the patch. A potential approach is to use the attribute() function with a crafted array or object.
3. Submit the payload. If successful, the sandbox is bypassed, and arbitrary code execution is achieved.

Example Payload (Hypothetical):

{{ attribute(_self, 'someMethod', ['arg1', 'arg2']) }}

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual Twig template submissions or modifications.
• Look for templates containing suspicious functions like attribute(), _self, or _context.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately update Twig to version 1.44.8, 2.16.1, or 3.14.0.
• If patching is not possible, disable the sandbox feature and implement alternative input validation.
• Restrict the ability for users to submit or modify templates.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, as no exploit code is public)
• Network Signatures: (None specific, but look for unusual POST requests containing Twig template code)
• Log Entries: Look for errors related to the Twig sandbox, such as "Sandbox not allowed" or "Call to undefined function" in the application logs.
• Process Anomalies: Unexpected PHP processes executing system commands.

Detection Engineering

YARA Rule

rule CVE_2024_45411_Twig_Sandbox_Bypass {
    meta:
        description = "Detects potential Twig sandbox bypass attempts"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45411"
    strings:
        $twig_function = /attribute\s*\(/ nocase
        $twig_self = /_self/ nocase
        $twig_context = /_context/ nocase
        $twig_globals = /_globals/ nocase
    condition:
        any of them
}

Sigma Rule

title: Potential Twig Sandbox Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects requests containing suspicious Twig template code
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45411
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'attribute('
            - '_self'
            - '_context'
            - '_globals'
    condition: selection
falsepositives:
    - Legitimate use of these functions in templates
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45411 Twig Sandbox Bypass Attempt"; flow:to_server; content:"POST"; http_method; content:"attribute("; http_client_body; nocase; content:"_self"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Twig to version 1.44.8, 2.16.1, or 3.14.0 immediately.
2. Verify: Run composer show twig/twig to check the installed version.
3. Restrict: If patching is delayed, disable the Twig sandbox and implement strict input validation for any user-contributed templates.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) rule to block requests containing suspicious Twig syntax.
• Regularly audit dependencies for known vulnerabilities using tools like composer audit.
• Follow the principle of least privilege for template execution.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.