PHP Code Injection by malicious block or filename in Smarty
Published 25 May 2022 · Updated 21 Feb 2024
Affected packages
- Affected
- <3.1.45
- Fixed in
- 3.1.45
composer require smarty/smarty:^3.1.45- Affected
- >=4.0.0 <4.1.1
- Fixed in
- 4.1.1
composer require smarty/smarty:^4.1.1Details
Impact
Template authors could inject php code by choosing a malicous {block} name or {include} file name. Sites that cannot fully trust template authors should update asap.
Patches
Please upgrade to the most recent version of Smarty v3 or v4.
Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
References
_Are there any links users can visit to find out more?_
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Smarty repo
Is GHSA-634x-pc3q-cf4c in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected smarty/smarty, and gives you the command that fixes it.
References
- Linkgithub.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-29221
- Linkgithub.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2022-29221.yaml
- Packagegithub.com/smarty-php/smarty
- Linkgithub.com/smarty-php/smarty/releases/tag/v3.1.45
- Linkgithub.com/smarty-php/smarty/releases/tag/v4.1.1
- Linklists.debian.org/debian-lts-announce/2022/05/msg00044.html
- Linklists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ
- Linklists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI
- Linksecurity.gentoo.org/glsa/202209-09
- Linkwww.debian.org/security/2022/dsa-5151
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.