Twig up to 1.13.x/2.6.x Sandbox __toString information disclosure

Summaryinfo

A vulnerability classified as problematic has been found in Twig up to 1.13.x/2.6.x. Affected is the function __toString of the component Sandbox. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2019-9942. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Twig up to 1.13.x/2.6.x. This issue affects the function __toString of the component Sandbox. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.

The bug was discovered 03/12/2019. The weakness was released 03/23/2019 (Website). It is possible to read the advisory at seclists.org. The identification of this vulnerability is CVE-2019-9942 since 03/23/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 11 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 176747 (Debian Security Update for twig (DSA 4419-1)).

Upgrading to version 1.38.0 or 2.7.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Twig

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion