CVE-2025-24374

Executive Summary

CVE-2025-24374 is a reflected Cross-Site Scripting (XSS) vulnerability in the Twig template engine for PHP. The flaw exists in the handling of the ?? (null coalescing) operator, where the left-hand side expression is not properly escaped before output. This allows an attacker to inject arbitrary HTML and JavaScript into rendered templates, potentially leading to session hijacking, data theft, or defacement. The vulnerability affects all versions of Twig prior to 3.19.0. The CVSS score is 4.3 (Medium), and no public exploit code or proof-of-concept is currently available. The vendor has released a fix in version 3.19.0.

Supply Chain & Package Security

Twig is a widely used template engine in the PHP ecosystem, often installed via Composer. The vulnerability is present in the twig/twig package. Organizations using Twig in their PHP applications should immediately update to version 3.19.0 or later. The package is distributed through Packagist, and the fix is available in the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The vulnerability requires user interaction (e.g., clicking a crafted link) and results in limited impact on confidentiality and integrity. The threat level is considered medium due to the low complexity and network-based attack vector.

Deep Dive & Mechanics

The vulnerability resides in the Twig template engine's handling of the ?? (null coalescing) operator. When a template uses this operator, the left-hand side expression is evaluated and output without proper HTML escaping. This means that if an attacker can control the value of the left-hand side expression (e.g., through user input or a template variable), they can inject arbitrary JavaScript or HTML.

For example, consider a template that outputs a user-provided value using the ?? operator:

{{ user_input ?? 'default' }}

If user_input contains malicious JavaScript, it will be rendered unescaped, leading to XSS.

The fix in version 3.19.0 ensures that the left-hand side expression is properly escaped using Twig's built-in escaping mechanisms (e.g., escape('html')).

Vulnerable vs. Patched Code

Vulnerable Code (Twig < 3.19.0):

// In the compiler, the ?? operator is compiled without escaping the left side
$compiler->raw('(isset(')
    ->subcompile($node->getNode('left'))
    ->raw(') ? ')
    ->subcompile($node->getNode('left'))
    ->raw(' : ')
    ->subcompile($node->getNode('right'))
    ->raw(')');

Patched Code (Twig 3.19.0):

// The left side is now wrapped in an escaping filter
$compiler->raw('(isset(')
    ->subcompile($node->getNode('left'))
    ->raw(') ? $this->env->getExtension(\'Twig\\Extension\\EscaperExtension\')->escape(')
    ->subcompile($node->getNode('left'))
    ->raw(', \'html\') : ')
    ->subcompile($node->getNode('right'))
    ->raw(')');

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to find a Twig template that uses the ?? operator with user-controlled input on the left side. A typical attack vector would be a reflected XSS scenario where the attacker crafts a URL containing malicious JavaScript.

Example Attack URL:

http://vulnerable-site.com/page?name=<script>alert('XSS')</script>

If the template uses {{ name ?? 'default' }}, the script will execute.

Proof-of-Concept (No public exploit available):

{# Vulnerable template #}
{{ user_input ?? 'safe' }}

If user_input is set to <img src=x onerror=alert(1)>, the payload will execute.

Blue Team

To detect exploitation attempts, monitor for unusual patterns in HTTP requests, especially those containing script tags or event handlers in query parameters. Use the following detection rules.

Indicators of Compromise (IOCs)

• Network Indicators:

  • HTTP requests containing <script>, onerror=, onload=, or similar XSS payloads in query parameters or POST data.
  • Requests to endpoints that use Twig templates with the ?? operator.

• File Indicators:

  • Presence of Twig template files (.twig) that use the ?? operator without proper escaping.

• Log Indicators:

  • Web server logs showing 200 responses to requests with XSS payloads.
  • Application logs showing unescaped output in rendered templates.

Detection Engineering

YARA Rule

rule CVE_2025_24374_Twig_XSS {
    meta:
        description = "Detects vulnerable Twig templates using the ?? operator without escaping"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24374"
    strings:
        $twig_operator = "??"
        $unescaped = /{{\s*[^}]*\?\?/
    condition:
        $twig_operator and $unescaped
}

Sigma Rule

title: CVE-2025-24374 Twig XSS Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing XSS payloads targeting Twig templates
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'alert('
    condition: selection
falsepositives:
    - Legitimate use of script tags in non-Twig contexts
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24374 Twig XSS Exploitation Attempt"; flow:to_server; content:"<script>"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-24374 Twig XSS via onerror"; content:"onerror="; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-24374 Twig XSS via onload"; content:"onload="; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

1. Immediate Update: Upgrade Twig to version 3.19.0 or later. This is the only complete fix.
2. Input Validation: Implement strict input validation and sanitization for all user-supplied data that may be used in Twig templates.
3. Content Security Policy (CSP): Deploy a strong CSP header to mitigate the impact of XSS even if exploitation occurs.
4. Web Application Firewall (WAF): Use a WAF to block common XSS payloads in HTTP requests.
5. Code Review: Audit all Twig templates for use of the ?? operator and ensure proper escaping is applied.

Valters IT