CVE-2022-23614: Symfony Twig Sandbox RCE Vulnerability

CVE-2022-23614 Overview

CVE-2022-23614 is a code injection vulnerability in Symfony Twig, an open source template language for PHP. When Twig operates in sandbox mode, the arrow parameter of the sort filter must be a closure to prevent attackers from executing arbitrary PHP functions. In affected versions, this constraint was not properly enforced, allowing attackers to inject and execute arbitrary PHP code by passing non-closure callables to the sort filter.

Critical Impact
Successful exploitation allows remote attackers to execute arbitrary PHP code on vulnerable systems without authentication, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

Symfony Twig (versions prior to patched releases)
Fedora 34 and Fedora 35
Debian Linux 11.0

Discovery Timeline

2022-02-04 - CVE-2022-23614 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-23614

Vulnerability Analysis

The vulnerability exists in Twig's sandbox security mechanism, which is designed to safely execute untrusted templates by restricting access to dangerous PHP functions and objects. The sort filter accepts an optional arrow parameter that allows custom sorting logic through a callback function. In secure configurations, this parameter should only accept closures (anonymous functions) to prevent attackers from specifying arbitrary PHP functions as callbacks.

The flaw occurred because the sort filter implementation did not validate that the arrow parameter was specifically a Closure object. This allowed attackers to pass string-based callable references (such as 'system', 'exec', or other dangerous PHP functions) as the sorting callback, effectively bypassing the sandbox restrictions entirely.

Root Cause

The root cause lies in the insufficient type checking within the twig_sort_filter function in src/Extension/CoreExtension.php. The filter was registered without the needs_environment flag and lacked validation to ensure the callback parameter was a Closure when sandbox mode was enabled. This architectural oversight allowed arbitrary callable types to be processed, defeating the purpose of the sandbox security model.

Attack Vector

An attacker with the ability to control or inject Twig template content can exploit this vulnerability by crafting a malicious sort filter call that passes an arbitrary PHP function name as the arrow parameter. Since the sandbox mode fails to enforce the Closure requirement, the attacker's specified function executes with the template engine's privileges. The attack requires network access and no user interaction, making it highly exploitable in web application contexts where user-supplied template content is processed.

php

// Security patch in src/Extension/CoreExtension.php
// Before the fix, the sort filter did not require environment access
             // array helpers
             new TwigFilter('join', 'twig_join_filter'),
             new TwigFilter('split', 'twig_split_filter', ['needs_environment' => true]),
-            new TwigFilter('sort', 'twig_sort_filter'),
+            new TwigFilter('sort', 'twig_sort_filter', ['needs_environment' => true]),
             new TwigFilter('merge', 'twig_array_merge'),
             new TwigFilter('batch', 'twig_array_batch'),
             new TwigFilter('column', 'twig_array_column'),

Source: GitHub Commit

Detection Methods for CVE-2022-23614

Indicators of Compromise

Unusual PHP function calls originating from Twig template rendering processes
Web application logs showing sort filter usage with suspicious callback parameters
Unexpected system command execution or file system access from PHP processes
Network connections or data exfiltration originating from web server processes

Detection Strategies

Monitor PHP application logs for template parsing errors or unexpected function call patterns
Implement web application firewalls (WAF) with rules to detect malicious Twig template syntax
Review application code for instances where user-controlled input reaches Twig template rendering
Deploy runtime application self-protection (RASP) solutions to detect code injection attempts

Monitoring Recommendations

Enable verbose logging for Twig template compilation and execution processes
Configure alerting for PHP error logs indicating sandbox policy violations
Monitor for unexpected child processes spawned by PHP-FPM or web server workers
Implement file integrity monitoring on web application directories

How to Mitigate CVE-2022-23614

Immediate Actions Required

Upgrade Symfony Twig to version 2.14.11 or later immediately
Review application code to identify all Twig sandbox implementations
Audit template sources to ensure no untrusted content can be rendered
Apply vendor-provided security patches from Fedora or Debian if applicable

Patch Information

Symfony has released security patches that enforce Closure validation for the arrow parameter in the sort filter when sandbox mode is enabled. The fix modifies the sort filter registration to include the needs_environment flag, enabling proper security checks. Patches are available through the official GitHub Security Advisory and distribution-specific advisories including Debian Security Advisory DSA-5107.

Workarounds

Disable sandbox mode entirely if user-controlled template content is not required
Implement strict input validation to prevent untrusted content from reaching template rendering
Use a web application firewall to block requests containing suspicious Twig filter syntax
Consider implementing content security policies to restrict template sources

bash

# Update Twig via Composer to the patched version
composer require twig/twig:^2.14.11

# For Debian-based systems, apply the security update
apt-get update && apt-get install --only-upgrade php-twig

# For Fedora systems
dnf update php-twig