CVE-2021-26120
📋 TL;DR
CVE-2021-26120 is a critical code injection vulnerability in Smarty template engine that allows attackers to execute arbitrary PHP code via specially crafted {function name=} tags. This affects all applications using Smarty templates before version 3.1.39. The vulnerability can lead to complete system compromise.
💻 Affected Systems
- Smarty PHP Template Engine
📦 What is this software?
Smarty by Smarty
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server takeover, data exfiltration, and lateral movement within the network.
Likely Case
Web application compromise allowing attackers to execute arbitrary code, access sensitive data, and potentially pivot to other systems.
If Mitigated
Limited impact with proper input validation and output encoding, though the vulnerability remains exploitable if templates accept user input.
🎯 Exploit Status
Exploitation requires user input to reach the template engine's function name parsing. Public proof-of-concept code exists demonstrating the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.39 and later
Vendor Advisory: https://github.com/smarty-php/smarty/blob/master/CHANGELOG.md
Restart Required: No
Instructions:
1. Update Smarty to version 3.1.39 or later using composer: 'composer require smarty/smarty:^3.1.39' 2. Replace the Smarty library files in your application with the patched version. 3. Clear any template caches.
🔧 Temporary Workarounds
Input Validation for Template Variables
allImplement strict input validation for any user-controlled data that reaches Smarty template functions
Disable Template Caching
allTemporarily disable Smarty template caching to prevent persistent exploitation
$smarty->caching = 0;
🧯 If You Can't Patch
- Implement WAF rules to block suspicious {function name=} patterns in HTTP requests
- Isolate affected applications behind reverse proxies with strict input filtering
🔍 How to Verify
Check if Vulnerable:
Check your composer.json or Smarty library files for version number. Versions below 3.1.39 are vulnerable.Check Version:
php -r "require_once 'Smarty.class.php'; $smarty = new Smarty(); echo 'Version: ' . Smarty::SMARTY_VERSION;"Verify Fix Applied:
Verify Smarty version is 3.1.39 or higher. Test with a safe payload to confirm the vulnerability is patched.📡 Detection & Monitoring
Log Indicators:
- Unusual {function name=} patterns in application logs
- PHP execution errors from template parsing
- Unexpected file creation or modification
Network Indicators:
- HTTP requests containing crafted {function name=} payloads
- Unusual outbound connections from web server
SIEM Query:
web_access_logs | where url contains "{function name=" or url contains "%7Bfunction%20name%3D"🔗 References
- https://github.com/smarty-php/smarty/blob/master/CHANGELOG.md
- https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html
- https://security.gentoo.org/glsa/202105-06
- https://www.debian.org/security/2022/dsa-5151
- https://github.com/smarty-php/smarty/blob/master/CHANGELOG.md
- https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html
- https://security.gentoo.org/glsa/202105-06
- https://www.debian.org/security/2022/dsa-5151
