CVE-2024-51755

Executive Summary

CVE-2024-51755 is a low-severity (CVSS 2.2) security vulnerability in the Twig template language for PHP. The flaw resides in the sandbox security mechanism, where Array-like objects were not properly checked against the security policy. An attacker with the ability to supply template code within a sandboxed environment could access attributes of these objects that should have been restricted. The fix introduces a BC (backward compatibility) break by enforcing the property policy on Array-like objects and adjusting the order of the __isset() call to occur after the security check. This vulnerability has a very low EPSS score (0.0%), indicating a low probability of active exploitation in the wild. No public proof-of-concept code or exploit templates are currently available.

Supply Chain & Package Security

This vulnerability affects the Twig package, which is a dependency for many PHP projects and frameworks (e.g., Symfony, Drupal, Laravel). Organizations using Twig should audit their composer.json for the affected versions and update to the patched releases. The supply chain risk is moderate, as the vulnerability requires an attacker to already have the ability to execute template code within a sandbox, limiting the attack surface.

CVSS Breakdown & Threat Level

• CVSS Score: 2.2 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): High – Exploitation requires specific conditions (sandbox access and ability to supply template code).
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited information disclosure (attribute access).
• Integrity (I): None – No data modification.
• Availability (A): None – No denial of service.

Threat Level: Low. The high attack complexity and low impact make this a low-priority vulnerability for most organizations.

Deep Dive & Mechanics

The Twig sandbox is a security feature that restricts the operations a template can perform, such as calling functions, accessing object properties, and using methods. The vulnerability arises because the sandbox's security policy did not properly check access to attributes of Array-like objects (objects implementing ArrayAccess). This allowed an attacker to bypass the property policy and access attributes that should have been forbidden.

The fix addresses this by:

1. Applying the property policy to Array-like objects, ensuring that attribute access is checked against the allowed list.
2. Moving the __isset() method call to after the security check, preventing the attacker from using __isset() to probe for attribute existence before the policy is enforced.

This is a BC break because existing templates that relied on the previous (insecure) behavior may now fail if they attempt to access attributes that are not explicitly allowed by the security policy.

Vulnerable vs. Patched Code

Vulnerable Code (Twig < 3.11.2 / < 3.14.1):

// In the sandbox extension, attribute access for Array-like objects was not checked
public function checkAllowedProperty($obj, $property)
{
    // No check for ArrayAccess objects
    // __isset() was called before the security check
    if ($obj instanceof \ArrayAccess) {
        return isset($obj[$property]); // Bypasses security policy
    }
    // ... rest of the check
}

Patched Code (Twig >= 3.11.2 / >= 3.14.1):

// In the sandbox extension, attribute access for Array-like objects is now checked
public function checkAllowedProperty($obj, $property)
{
    // Apply property policy to all objects, including ArrayAccess
    $this->checkProperty($obj, $property);
    
    // __isset() is now called after the security check
    if ($obj instanceof \ArrayAccess) {
        return $obj->offsetExists($property);
    }
    // ... rest of the check
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Twig sandbox environment where you can supply template code.
• The target application must be using an unpatched version of Twig (< 3.11.2 or < 3.14.1).

Exploitation Steps:

1. Identify a Twig template injection point within a sandboxed context.
2. Craft a template that accesses an attribute of an Array-like object that should be restricted.
3. Example payload:

   {{ myArrayObject.sensitiveAttribute }}
   

   Where myArrayObject is an Array-like object (e.g., implementing ArrayAccess) and sensitiveAttribute is a property that should be blocked by the security policy.

Expected Outcome: The attacker can read the value of sensitiveAttribute, bypassing the sandbox restrictions.

Blue Team

Detection:

• Monitor for unusual Twig template submissions that attempt to access object attributes.
• Look for patterns in logs that indicate sandbox bypass attempts, such as repeated access to Array-like objects.

Hunting:

• Search for Twig template files or user-supplied templates that contain references to ArrayAccess objects or use the {{ }} syntax to access properties.
• Review application logs for errors related to Twig sandbox violations.

Mitigation:

• Immediately update Twig to version 3.11.2 or 3.14.1.
• If immediate patching is not possible, restrict access to the Twig sandbox feature or disable it temporarily.

Indicators of Compromise (IOCs)

• Log Entries: Twig sandbox violation errors in application logs.
• Network Traffic: Unusual POST requests containing Twig template code.
• File System: Modified Twig template files with suspicious attribute access patterns.
• Process: PHP processes executing Twig templates with unexpected attribute access.

Detection Engineering

YARA Rule

rule CVE_2024_51755_Twig_Sandbox_Bypass {
    meta:
        description = "Detects Twig templates attempting to bypass sandbox by accessing ArrayAccess attributes"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-51755"
        severity = "low"
    strings:
        $twig_sandbox = /\\{\\{\\s*\\w+\\.\\w+\\s*\\}\\}/ nocase
        $array_access = /ArrayAccess|ArrayObject|offsetGet|offsetExists/ nocase
    condition:
        $twig_sandbox and $array_access
}

Sigma Rule

title: Twig Sandbox Bypass via ArrayAccess Attribute Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-51755 by accessing ArrayAccess attributes in Twig templates
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51755
logsource:
    category: application
    product: php
    service: twig
detection:
    selection:
        EventID: 'TwigSandboxViolation'
        Message|contains: 'ArrayAccess'
    condition: selection
falsepositives:
    - Legitimate use of ArrayAccess objects in allowed templates
level: low

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51755 Twig Sandbox Bypass Attempt"; flow:to_server; content:"{{"; content:"."; content:"}}"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Twig to version 3.11.2 or 3.14.1 immediately.

   composer require twig/twig:^3.11.2
   

2. Verify: After updating, test your templates to ensure compatibility with the BC break.

Long-Term Mitigations:

• Least Privilege: Ensure that the Twig sandbox is configured with the minimum necessary permissions.
• Input Validation: Validate and sanitize all user-supplied template code before rendering.
• Monitoring: Implement logging and monitoring for Twig sandbox violations.
• Regular Updates: Keep Twig and all dependencies up to date.

Workarounds: No known workarounds exist. Patching is the only reliable mitigation.

Valters IT
DevSecOps & Cyber Threat Intelligence