CVE-2024-45411

What it actually does

The vulnerability bypasses Twig sandbox security checks under certain conditions, allowing user-supplied templates to execute operations normally restricted by the sandbox policy.

Why it matters to the business

Applications relying on Twig for rendering user-contributed templates face risk of unauthorized code execution or data access, though low exploit probability and absence from known campaigns reduce immediate operational urgency.

How an attack unfolds

An attacker supplies a crafted template to an application using a vulnerable Twig version; due to incomplete sandbox enforcement, the template evades restrictions and performs actions such as file access or function calls that should be blocked.

How to fix it

Upgrade twigphp/twig to version 1.44.8, 2.16.1, or 3.14.0; the fix is present in commit b1f009c449e435a0384814e67205d9190a4d050e.

How to confirm the fix worked

Confirm the installed Twig version meets or exceeds a fixed release, then re-test sandboxed templates with previously restricted operations to verify enforcement.

Typical attack path

1. Locate a web application accepting user-controlled Twig templates
2. Craft a template payload that targets missing sandbox checks
3. Submit the template through normal input channels
4. Observe or leverage the bypassed restrictions to access restricted resources or execute code

How to detect it

Examine application and web server logs for unusual template rendering activity or error patterns that indicate sandbox bypass attempts; correlate with template input sources.

What your security team should do

• Prioritize upgrade of twigphp/twig to a fixed version across all instances
• Audit code paths that render untrusted templates and ensure sandbox mode is consistently applied
• Review dependency management to prevent reintroduction of vulnerable Twig releases