CVE-2021-21408
📋 TL;DR
CVE-2021-21408 is a vulnerability in Smarty PHP template engine that allows template authors to execute restricted static PHP methods, potentially leading to remote code execution. This affects all Smarty users running versions before 3.1.43 or 4.0.3. The vulnerability enables attackers to bypass intended security restrictions in template processing.
💻 Affected Systems
- Smarty PHP Template Engine
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Smarty by Smarty
Smarty by Smarty
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Template authors or attackers with template access can execute arbitrary PHP code, potentially gaining application-level access and data exposure.
If Mitigated
With proper access controls and template author restrictions, impact is limited to authorized template functionality only.
🎯 Exploit Status
Exploitation requires template author access or ability to inject/modify templates. Public proof-of-concept demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.43 or 4.0.3
Vendor Advisory: https://github.com/smarty-php/smarty/security/advisories/GHSA-4h9c-v5vg-5m6m
Restart Required: No
Instructions:
1. Backup current Smarty installation. 2. Update via composer: 'composer require smarty/smarty:^3.1.43' or 'composer require smarty/smarty:^4.0.3'. 3. Verify update with 'composer show smarty/smarty'. 4. Test application functionality.
🔧 Temporary Workarounds
Restrict Template Author Permissions
allLimit who can create or modify Smarty templates to trusted administrators only.
Disable PHP Function Execution
allConfigure Smarty to disable PHP function execution in templates via security settings.
$smarty->security = true;
$smarty->security_settings['IF_FUNCS'][] = 'none';
🧯 If You Can't Patch
- Implement strict access controls for template modification and review all existing templates for malicious code.
- Deploy web application firewall rules to detect and block attempts to exploit template execution vulnerabilities.
🔍 How to Verify
Check if Vulnerable:
Check Smarty version in composer.json or via 'composer show smarty/smarty'. If version is below 3.1.43 (for v3) or below 4.0.3 (for v4), system is vulnerable.Check Version:
composer show smarty/smarty | grep versionsVerify Fix Applied:
After update, verify version is 3.1.43 or higher (for v3) or 4.0.3 or higher (for v4) using 'composer show smarty/smarty'.📡 Detection & Monitoring
Log Indicators:
- Unusual template modification activity
- PHP execution errors in template files
- Unexpected system command execution from web process
Network Indicators:
- HTTP requests with unusual template parameters
- POST requests modifying template content
SIEM Query:
source="web_logs" AND (uri="*.tpl" OR uri="*.php") AND (method="PUT" OR method="POST") AND size>10000🔗 References
- https://github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664
- https://github.com/smarty-php/smarty/releases/tag/v3.1.43
- https://github.com/smarty-php/smarty/releases/tag/v4.0.3
- https://github.com/smarty-php/smarty/security/advisories/GHSA-4h9c-v5vg-5m6m
- https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/
- https://security.gentoo.org/glsa/202209-09
- https://www.debian.org/security/2022/dsa-5151
- https://github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664
- https://github.com/smarty-php/smarty/releases/tag/v3.1.43
- https://github.com/smarty-php/smarty/releases/tag/v4.0.3
- https://github.com/smarty-php/smarty/security/advisories/GHSA-4h9c-v5vg-5m6m
- https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/
- https://security.gentoo.org/glsa/202209-09
- https://www.debian.org/security/2022/dsa-5151
