CVE-2024-51755

What it actually does

The sandbox security policy in Twig fails to enforce checks on attributes of Array-like objects, allowing direct attribute access that bypasses the property policy; the __isset() method is invoked only after the missing security check.

Why it matters to the business

Applications relying on Twig sandboxing for untrusted templates may expose limited sensitive data from array-like structures, increasing risk of information leakage in multi-tenant or user-generated content environments; low exploitability and no known active campaigns reduce immediate urgency but still require prompt patching.

How an attack unfolds

An attacker with the ability to supply or influence Twig templates executed inside a sandbox crafts input that references attributes on Array-like objects; because the security policy is not applied to these attributes, the attacker retrieves protected data that the policy was intended to block.

How to fix it

Upgrade twigphp/twig to version 3.11.2, 3.14.1, or the commit 5b580ec1882b54c98cbd8c0f8a3ca5d1904db6b1; no workarounds exist.

How to confirm the fix worked

After upgrade, confirm that attempts to access attributes of Array-like objects inside sandboxed templates now correctly invoke the property policy and are denied when the policy forbids them; review template rendering logs for policy enforcement messages.

Typical attack path

1. Identify a Twig-based application that renders user-controlled or untrusted templates inside sandbox mode
2. Craft template syntax that accesses attributes on an Array-like object
3. Submit the template for rendering
4. Observe successful retrieval of attribute values that the security policy should have denied

How to detect it

Review application logs for template rendering activity involving sandbox mode and unexpected attribute access on array objects; examine any custom Twig extensions or policies for references to ArrayAccess or similar interfaces.

What your security team should do

• Prioritize upgrade of all Twig installations to the fixed versions within standard change windows
• Audit any custom security policies to ensure they cover Array-like objects after the update
• Monitor vendor announcements for additional BC-break impacts from the __isset() ordering change