A critical sandbox bypass vulnerability in the Twig template engine allows unauthorized method execution, potentially leading to significant information disclosure.

The vulnerability exists in the SecurityPolicy::checkMethodAllowed function, which fails to restrict method calls on subclasses of Twig\Markup. This flaw allows an unauthenticated attacker to bypass sandbox protections and invoke any public method of a Markup-derived class.

The ability to execute arbitrary methods within a sandboxed template environment can lead to the unauthorized disclosure of sensitive data or the manipulation of application logic. With a CVSS score of 8.7, this high-severity vulnerability poses a substantial risk to application integrity and confidentiality, particularly in environments that rely on Twig for rendering user-supplied or untrusted templates.

Immediate Action: Update the Twig library to version 3.27.0 or later to ensure the security policy correctly restricts method calls on Markup objects.

Proactive Monitoring: Review application logs for unexpected method calls or unusual activity originating from template rendering processes that handle Markup-derived objects.

Compensating Controls: If immediate patching is not feasible, restrict the passing of complex Markup-derived objects into sandboxed templates and evaluate the implementation of strict allow-lists for template-accessible objects.

Public Exploit Available: No

Given the high CVSS score and the nature of the sandbox bypass, organizations utilizing the Twig template engine should prioritize upgrading to version 3.27.0. Failure to patch this vulnerability leaves applications susceptible to unauthorized method invocation, which may be leveraged to compromise protected data or circumvent security controls embedded within the application layer.