Monday, November 8, 2021



### Impact
Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously. 

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible. 

### Patches
Version 1.1.1 has addressed this vulnerability. 
$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)


', $params); ``` ### Workarounds Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade. ### References As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now. ### For more information If you have any questions or comments about this advisory: * Open an issue in [our repo](

References to Advisories, Solutions, and Tools

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]

Copyright © 2021 Vulnerability Database | Cyber Details™

thank you Templateism for the design - You should have written the code a little more complicated - Nothing Encrypted anymore