CVE-2022-39261: Symfony Twig Path Traversal Vulnerability

CVE-2022-39261 Overview

CVE-2022-39261 is a path traversal vulnerability affecting Twig, a popular template language for PHP. The vulnerability exists in the filesystem loader component when template names are derived from user input. An attacker can exploit the source or include statements to read arbitrary files from outside the designated templates directory by using a specially crafted namespace path containing directory traversal sequences like @somewhere/../some.file. When such a malformed namespace is used, the validation mechanism is bypassed, allowing unauthorized file access.

Critical Impact

Attackers can read arbitrary sensitive files from the server filesystem, potentially exposing configuration files, credentials, source code, and other confidential data through template injection attacks.

Affected Products

• Symfony Twig versions 1.x prior to 1.44.7
• Symfony Twig versions 2.x prior to 2.15.3
• Symfony Twig versions 3.x prior to 3.4.3
• Drupal Core (dependent on vulnerable Twig versions)
• Fedora 35, 36, and 37
• Debian Linux 10.0 and 11.0

Discovery Timeline

• 2022-09-28 - CVE-2022-39261 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-39261

Vulnerability Analysis

This path traversal vulnerability (CWE-22) occurs in Twig's filesystem loader component. The core issue lies in the order of operations when validating template names that contain namespace prefixes. When a template name using a namespace format (e.g., @namespace/path) is processed, the validation function was being called on the full name including the namespace prefix, rather than on the resolved shortname after namespace parsing.

This ordering flaw means that an attacker can craft a template path using a namespace prefix followed by directory traversal sequences (../) that bypass the security validation entirely. The validation checks the namespace-prefixed string, which appears valid, but the actual file resolution uses the shortname which can traverse outside the intended template directory.

The vulnerability enables unauthorized reading of arbitrary files on the filesystem where the web application has read permissions. This could expose sensitive configuration files, database credentials, application source code, environment variables, and other confidential data stored on the server.

Root Cause

The root cause is improper sequencing of input validation in the FilesystemLoader.php file. The original code called validateName($name) before parsing the namespace and extracting the shortname. This meant validation occurred against the raw user-supplied input containing the namespace prefix, rather than against the actual filesystem path that would be loaded. The namespace prefix effectively "masked" the traversal sequences from the validation routine.

Attack Vector

The attack can be executed remotely over the network without requiring authentication. An attacker needs to find an application endpoint where user-controlled input is used as a template name with the source or include Twig statements. By supplying a malicious template path like @somewhere/../../../etc/passwd, the attacker can read files outside the configured templates directory. The attack requires no user interaction and can be automated.

// Original vulnerable code flow in FilesystemLoader.php
// Validation was performed BEFORE namespace parsing
$this->validateName($name);  // Validates "@namespace/../secret.file" - passes!
list($namespace, $shortname) = $this->parseName($name);
// shortname now contains "../secret.file" - traversal succeeds

// Fixed code flow - validation occurs AFTER parsing
list($namespace, $shortname) = $this->parseName($name);
$this->validateName($shortname);  // Now validates "../secret.file" - correctly rejected

Source: GitHub Commit

Detection Methods for CVE-2022-39261

Indicators of Compromise

• Web server access logs containing template paths with @ namespace prefixes followed by ../ sequences
• Error logs showing attempts to access files outside the templates directory
• Unusual file read operations targeting sensitive system files like /etc/passwd or application configuration files
• HTTP requests with encoded directory traversal patterns such as %2e%2e%2f or ..%2f in template-related parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing directory traversal patterns (../, ..\, encoded variants) in URL parameters and POST data
• Deploy application-level logging to monitor template loading operations and flag any attempts to load templates with namespace prefixes containing path separators
• Use file integrity monitoring (FIM) on sensitive configuration files to detect unauthorized read access attempts
• Configure SentinelOne Singularity to monitor PHP process activity for suspicious file read operations outside expected directories

Monitoring Recommendations

• Enable verbose logging in Twig/Symfony applications to capture template loading errors and access attempts
• Monitor for anomalous spikes in file read operations from web server processes
• Set up alerts for any access to sensitive files from web application contexts
• Review application logs regularly for patterns indicating exploitation attempts against template rendering endpoints

How to Mitigate CVE-2022-39261

Immediate Actions Required

• Upgrade Twig immediately to version 1.44.7, 2.15.3, or 3.4.3 depending on your installed major version
• For Drupal installations, apply the security update referenced in Drupal Security Advisory SA-CORE-2022-016
• Audit application code to identify any locations where user input is used in template names for source or include statements
• Implement input validation at the application layer to reject any template names containing ../ sequences before passing to Twig

Patch Information

The vulnerability is fixed in Twig versions 1.44.7, 2.15.3, and 3.4.3. The fix reorders the validation logic to ensure validateName() is called on the parsed shortname after namespace extraction, rather than on the raw input. The security patch is available via the GitHub commit 35f3035c5deb0041da7b84daf02dea074ddc7a0b. Additional vendor advisories are available from Debian Security Advisory DSA-5248 and through Fedora package announcements.

Workarounds

• There are no known workarounds aside from upgrading to the patched versions according to the official security advisory
• As a defense-in-depth measure, avoid passing user-controlled input directly to template loading functions
• Implement strict allowlisting of permitted template names at the application level if user input must influence template selection
• Use application-level path validation to strip or reject any input containing directory traversal sequences before Twig processing

# Upgrade Twig via Composer to the latest patched version
composer require twig/twig:^3.4.3

# For Twig 2.x installations
composer require twig/twig:^2.15.3

# For legacy Twig 1.x installations
composer require twig/twig:^1.44.7

# Verify installed version after upgrade
composer show twig/twig | grep versions