CVE-2021-41170
📋 TL;DR
This vulnerability in neoan3-apps/template allows remote code execution through template injection. Attackers can pass callable values (closures) that execute arbitrary code when processed by the template engine. All users who process user input or database values through the template engine are affected.
💻 Affected Systems
- neoan3-apps/template
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with arbitrary code execution, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution leading to application takeover, data manipulation, and potential privilege escalation.
If Mitigated
Limited impact if only hardcoded values are used, but this defeats the purpose of a template engine.
🎯 Exploit Status
The vulnerability is well-documented in public advisories and requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.1
Vendor Advisory: https://github.com/sroehrl/neoan3-template/security/advisories/GHSA-3v56-q6r6-4gcw
Restart Required: No
Instructions:
1. Update package via composer: composer require neoan3-apps/template:^1.1.1
2. Verify the update completed successfully
3. Test template functionality with your application
🔧 Temporary Workarounds
Restrict template input to hardcoded values only
allOnly use hardcoded, non-user-controlled values in templates
🧯 If You Can't Patch
- Implement strict input validation to reject any values that could be callable or contain executable code
- Isolate the template engine in a restricted environment with minimal permissions
🔍 How to Verify
Check if Vulnerable:
Check composer.json or package version: if using neoan3-apps/template version <1.1.1, you are vulnerableCheck Version:
composer show neoan3-apps/template | grep versionsVerify Fix Applied:
Verify installed version is 1.1.1 or higher: composer show neoan3-apps/template📡 Detection & Monitoring
Log Indicators:
- Unexpected PHP execution errors
- Unusual template processing patterns
- Suspicious user input containing PHP functions or closures
Network Indicators:
- HTTP requests containing PHP code or serialized closures in template parameters
SIEM Query:
source="web_logs" AND (message="*closure*" OR message="*callable*" OR message="*__invoke*")🔗 References
- https://github.com/sroehrl/neoan3-template/commit/4a2c9570f071d3c8f4ac790007599cba20e16934
- https://github.com/sroehrl/neoan3-template/issues/8
- https://github.com/sroehrl/neoan3-template/security/advisories/GHSA-3v56-q6r6-4gcw
- https://github.com/sroehrl/neoan3-template/commit/4a2c9570f071d3c8f4ac790007599cba20e16934
- https://github.com/sroehrl/neoan3-template/issues/8
- https://github.com/sroehrl/neoan3-template/security/advisories/GHSA-3v56-q6r6-4gcw
