CVE-2022-23614

Name of the Vulnerable Software and Affected Versions Twig versions prior to the patched version

Description The issue arises from the lack of proper enforcement of the constraint that the arrow parameter of the sort filter must be a closure when in sandbox mode. This could lead to code injection of arbitrary PHP code, allowing attackers to run arbitrary PHP functions. The patched versions now disallow calling non-closure in the sort filter.

Recommendations For all affected versions of Twig, users are advised to upgrade to a patched version to resolve the issue. As a temporary workaround, consider disabling the sort filter until a patch is available. Restrict access to the arrow parameter of the sort filter to minimize the risk of exploitation. Avoid using the arrow parameter in the affected sort filter until the issue is resolved.