[Security-news] Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2022-016

[security-news at drupal.org]

View online: https://www.drupal.org/sa-core-2022-016

Project: Drupal core [1]
Date: 2022-September-28
Security risk: *Critical* 18∕25
AC:Basic/A:Admin/CI:All/II:All/E:Proof/TD:All [2]
Vulnerability: Multiple vulnerabilities

Affected versions: >= 8.0.0 <9.3.22 || >= 9.4.0 <9.4.7
Description: 
Drupal uses the Twig [3] third-party library for content templating and
sanitization. Twig has released a security update [4] that affects Drupal.
Twig has rated the vulnerability as high severity.

Drupal core's code extending Twig has also been updated to mitigate a related
vulnerability.

Multiple vulnerabilities are possible if an untrusted user has access to
write Twig code, including potential unauthorized read access to private
files, the contents of other files on the server, or database credentials.

The vulnerability is mitigated by the fact that an exploit is only possible
in Drupal core with a restricted access administrative permission. Additional
exploit paths for the same vulnerability may exist with contributed or custom
code that allows users to write Twig templates.

Solution: 
Install the latest version:

   * If you are using Drupal 9.4, update to Drupal 9.4.7 [5].
   * If you are using Drupal 9.3, update to Drupal 9.3.22 [6].

All versions of Drupal 9 prior to 9.3.x are end-of-life and do not receive
security coverage. Note that Drupal 8 has reached its end of life [7].

Drupal 7 core does not include Twig and therefore is not affected.

Reported By: 
   * Fabien Potencier [8]
   * Nicolas Grekas [9]
   * James Williams [10]

Fixed By: 
   * xjm [11] of the Drupal Security Team
   * Alex Pott [12] of the Drupal Security Team
   * Sascha Grossenbacher [13]
   * Lee Rowlands [14] of the Drupal Security Team
   * Lauri Eskola [15], provisional member of the Drupal Security Team
   * Nathaniel Catchpole [16] of the Drupal Security Team
   * Dave Long [17], provisional member of the Drupal Security Team
   * cilefen  [18] of the Drupal Security Team
   * James Williams [19]
   * Benji Fisher [20], provisional member of the Drupal Security Team


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://twig.symfony.com/
[4]
https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader
[5] https://www.drupal.org/project/drupal/releases/9.4.7
[6] https://www.drupal.org/project/drupal/releases/9.3.22
[7] https://www.drupal.org/psa-2021-06-29
[8] https://www.drupal.org/user/1467782
[9] https://www.drupal.org/user/3407972
[10] https://www.drupal.org/user/592268
[11] https://www.drupal.org/user/65776
[12] https://www.drupal.org/user/157725
[13] https://www.drupal.org/user/214652
[14] https://www.drupal.org/user/395439
[15] https://www.drupal.org/user/1078742
[16] https://www.drupal.org/user/35733
[17] https://www.drupal.org/user/246492
[18] https://www.drupal.org/user/1850070
[19] https://www.drupal.org/user/592268
[20] https://www.drupal.org/user/683300