CVE-2024-45411: Symfony Twig Auth Bypass Vulnerability

CVE-2024-45411 Overview

CVE-2024-45411 is a sandbox bypass vulnerability in Twig, the template language for PHP maintained by the Symfony project. Under specific circumstances involving previously loaded templates, the sandbox security checks fail to execute. This allows user-contributed templates to bypass the sandbox restrictions designed to constrain untrusted template input. The flaw affects Twig versions prior to 1.44.8, 2.16.1, and 3.14.0. Applications that allow users to author or submit templates and rely on Twig's sandbox extension for isolation are exposed. The issue is tracked under [CWE-693] (Protection Mechanism Failure) and was published to the NVD on September 9, 2024.

Critical Impact
Attackers controlling template content can bypass Twig sandbox enforcement and invoke restricted functions, tags, or filters, undermining the integrity guarantees of multi-tenant or user-driven templating workflows.

Affected Products

Symfony Twig versions prior to 1.44.8
Symfony Twig versions prior to 2.16.1
Symfony Twig versions prior to 3.14.0

Discovery Timeline

2024-09-09 - CVE-2024-45411 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-45411

Vulnerability Analysis

Twig provides a sandbox extension that restricts which tags, filters, functions, methods, and properties untrusted templates can use. The sandbox is enforced through a checkSecurity() call on Template instances when they execute inside a sandboxed context. The vulnerability occurs when a template has already been loaded outside of a sandboxed context before being included from inside one. In that case, the security checks intended to validate the template against the sandbox policy do not run, and the included template executes with the privileges it carried at load time. This effectively bypasses the protection mechanism the sandbox is meant to provide, allowing user-contributed template content to call constructs that were intended to be blocked.

Root Cause

The defect resides in the include logic of CoreExtension.php. When a TemplateWrapper or Template object was passed to include, the runtime relied on a deferred checkSecurity() invocation to enforce sandboxing. If the template was already loaded and cached, the path that triggered re-validation did not execute consistently, so the sandbox state at execution time did not reflect the restrictions the developer expected.

Attack Vector

Exploitation requires the attacker to supply or influence template content that is rendered through Twig with the sandbox extension enabled. In a multi-tenant SaaS or CMS context that accepts user templates, an attacker can craft a template that depends on another template previously instantiated outside the sandbox, then invoke disallowed filters, functions, or methods through the include path to perform actions such as data exfiltration or further server-side manipulation.

php

// Patch excerpt from src/Extension/CoreExtension.php
// The vulnerable post-condition block that failed to enforce checks
// in all execution paths was removed in favor of corrected sandbox handling.

            if (!$alreadySandboxed = $sandbox->isSandboxed()) {
                $sandbox->enableSandbox();
            }
-
-            foreach ((\is_array($template) ? $template : [$template]) as $name) {
-                // if a Template instance is passed, it might have been instantiated outside of a sandbox, check security
-                if ($name instanceof TemplateWrapper || $name instanceof Template) {
-                    $name->unwrap()->checkSecurity();
-                }
-            }
        }

        try {

Source: twigphp/Twig commit 11f68e2

Detection Methods for CVE-2024-45411

Indicators of Compromise

Unexpected calls to PHP functions, filters, or object methods originating from Twig template rendering processes that should be sandboxed.
Web server or application logs showing rendering of user-submitted templates that reference previously cached templates by name.
Outbound network connections or file system writes initiated by PHP-FPM or web worker processes during template rendering operations.

Detection Strategies

Inventory all applications using Twig and identify versions below 1.44.8, 2.16.1, or 3.14.0 through software composition analysis.
Audit code paths that pass Template or TemplateWrapper instances to include and confirm the sandbox policy is applied consistently.
Review application logs for sandbox security exceptions and correlate against templates loaded earlier in the same request lifecycle.

Monitoring Recommendations

Enable Twig sandbox security exception logging and forward events to a centralized SIEM for correlation with web request telemetry.
Monitor PHP worker processes for anomalous child process creation, file access patterns, or network egress during template rendering.
Track deployments of the Twig package via dependency manifests (composer.lock) to confirm patched versions remain in production.

How to Mitigate CVE-2024-45411

Immediate Actions Required

Upgrade Twig to 1.44.8, 2.16.1, or 3.14.0 or later, depending on the major version branch in use.
Apply Debian LTS or distribution-specific package updates where Twig is installed through the OS package manager.
Review applications that accept user-contributed templates and treat the sandbox as defense-in-depth rather than the sole control until patching is verified.

Patch Information

The maintainers published the fix in three commits to src/Extension/CoreExtension.php, available at commit 11f68e2, commit 2102dd1, and commit 7afa198. Full advisory details are available in the GitHub Security Advisory GHSA-6j75-5wfj-gh66 and the Debian LTS Announcement.

Workarounds

Restrict template authoring to trusted users until the patched version is deployed.
Avoid passing pre-loaded Template or TemplateWrapper instances into sandboxed include calls; pass template names so the sandbox-aware loader handles security checks.
Tighten the sandbox policy to deny-by-default and explicitly allowlist required tags, filters, and functions, minimizing the impact of a bypass.

bash

# Update Twig via Composer to a patched release
composer require "twig/twig:^3.14.0"

# For applications on the 2.x branch
composer require "twig/twig:^2.16.1"

# For applications on the 1.x branch
composer require "twig/twig:^1.44.8"

# Verify the installed version
composer show twig/twig | grep versions