CVE-2022-29221
📋 TL;DR
This vulnerability in Smarty template engine allows template authors to inject PHP code through malicious {block} names or {include} file names. It affects sites where template authors are not fully trusted, potentially leading to remote code execution. The vulnerability is patched in Smarty versions 3.1.45 and 4.1.1.
💻 Affected Systems
- Smarty PHP Template Engine
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Smarty by Smarty
Smarty by Smarty
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Template authors with malicious intent could execute arbitrary PHP code, potentially accessing sensitive data or modifying application behavior.
If Mitigated
With proper access controls and trusted template authors only, impact is limited to authorized template modifications.
🎯 Exploit Status
Exploitation requires template author access. The vulnerability is in template parsing logic, making exploitation straightforward for malicious template authors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.45 or 4.1.1
Vendor Advisory: https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c
Restart Required: No
Instructions:
1. Backup your current Smarty installation. 2. Update via Composer: 'composer require smarty/smarty:^3.1.45' or 'composer require smarty/smarty:^4.1.1'. 3. Verify the update completed successfully. 4. Test your application functionality.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict template author permissions to trusted users only
- Implement strict input validation on all template names and block names
🔍 How to Verify
Check if Vulnerable:
Check your Smarty version. If using Composer: 'composer show smarty/smarty'. If manual install: check the Smarty.class.php file for version constant.Check Version:
php -r "require_once 'Smarty.class.php'; echo 'Smarty version: ' . Smarty::SMARTY_VERSION;"Verify Fix Applied:
Verify the version is 3.1.45 or higher for Smarty 3.x, or 4.1.1 or higher for Smarty 4.x.📡 Detection & Monitoring
Log Indicators:
- Unusual template file names containing special characters
- Unexpected PHP execution in template directories
- Template compilation errors with suspicious content
Network Indicators:
- Unusual outbound connections from web server after template modifications
- Unexpected file downloads to template directories
SIEM Query:
source="web_server" AND (template_name="*{php*}*" OR template_name="*system(*)*" OR template_name="*eval(*)*")🔗 References
- https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd
- https://github.com/smarty-php/smarty/releases/tag/v3.1.45
- https://github.com/smarty-php/smarty/releases/tag/v4.1.1
- https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c
- https://lists.debian.org/debian-lts-announce/2022/05/msg00044.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/
- https://security.gentoo.org/glsa/202209-09
- https://www.debian.org/security/2022/dsa-5151
- https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd
- https://github.com/smarty-php/smarty/releases/tag/v3.1.45
- https://github.com/smarty-php/smarty/releases/tag/v4.1.1
- https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c
- https://lists.debian.org/debian-lts-announce/2022/05/msg00044.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/
- https://security.gentoo.org/glsa/202209-09
- https://www.debian.org/security/2022/dsa-5151
