Summary
A code injection vulnerability in Smarty can cause attacker-controlled template data to be written into regenerated PHP cache files when template inheritance is used incorrectly.
If an attacker can supply crafted assigned data that reaches the affected caching path, arbitrary PHP code may execute when the generated cache is included, potentially resulting in remote code execution.
A code injection vulnerability in Smarty can cause attacker-controlled template data to be written into regenerated PHP cache files when template inheritance is used incorrectly.
If an attacker can supply crafted assigned data that reaches the affected caching path, arbitrary PHP code may execute when the generated cache is included, potentially resulting in remote code execution.
Affected context
The vulnerability may occur in Smarty applications that use extends: or multi-component template inheritance and regenerate PHP template cache files from assigned data. The risk depends on whether an attacker can influence the relevant template data and whether generated cache files are later included by the application.
The vulnerability may occur in Smarty applications that use extends: or multi-component template inheritance and regenerate PHP template cache files from assigned data. The risk depends on whether an attacker can influence the relevant template data and whether generated cache files are later included by the application.
Exploit preconditions
- Attack surface: Smarty template rendering and PHP cache generation
- Required access: Ability to influence assigned template data that reaches the affected inheritance path
- Trigger point: Regeneration and subsequent inclusion of a PHP template cache file
- Why exploitation is possible: The top-level
nocache_hashvalue may remain null, allowing a forged Smarty nocache marker in assigned data to be copied into generated PHP code
- Attack surface: Smarty template rendering and PHP cache generation
- Required access: Ability to influence assigned template data that reaches the affected inheritance path
- Trigger point: Regeneration and subsequent inclusion of a PHP template cache file
- Why exploitation is possible: The top-level
nocache_hashvalue may remain null, allowing a forged Smarty nocache marker in assigned data to be copied into generated PHP code
Why this happens
The underlying bug is an incomplete restoration of template-inheritance state during cache regeneration. When the top-level nocache_hash value is not restored, attacker-influenced data containing a specially formed internal marker may be copied verbatim into a PHP cache file.
This behavior maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), because data intended for template content crosses into generated executable PHP without adequate separation or validation.
The underlying bug is an incomplete restoration of template-inheritance state during cache regeneration. When the top-level nocache_hash value is not restored, attacker-influenced data containing a specially formed internal marker may be copied verbatim into a PHP cache file.
This behavior maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), because data intended for template content crosses into generated executable PHP without adequate separation or validation.
Potential impact
- An attacker may execute arbitrary PHP code in the application process
- Application secrets and configuration data could be exposed
- Application data may be modified, deleted, or poisoned
- Server-side access could be used for further compromise, depending on process privileges
- Availability may be affected through destructive or resource-intensive code execution
- An attacker may execute arbitrary PHP code in the application process
- Application secrets and configuration data could be exposed
- Application data may be modified, deleted, or poisoned
- Server-side access could be used for further compromise, depending on process privileges
- Availability may be affected through destructive or resource-intensive code execution
General mitigation guidance
Mitigation generally focuses on maintaining a strict separation between template data and generated executable code.
Common defensive patterns include:
- Using a maintained Smarty release that contains the relevant security correction
- Preventing untrusted values from being interpreted as template control markers or generated PHP syntax
- Applying strict context-aware validation and output encoding to assigned data
- Restricting template cache directories from untrusted write access
- Storing generated cache files outside user-controlled paths and applying least-privilege filesystem permissions
- Running the PHP process with only the permissions required by the application
- Disabling or isolating dynamic template features when they are not required
Mitigation generally focuses on maintaining a strict separation between template data and generated executable code.
Common defensive patterns include:
- Using a maintained Smarty release that contains the relevant security correction
- Preventing untrusted values from being interpreted as template control markers or generated PHP syntax
- Applying strict context-aware validation and output encoding to assigned data
- Restricting template cache directories from untrusted write access
- Storing generated cache files outside user-controlled paths and applying least-privilege filesystem permissions
- Running the PHP process with only the permissions required by the application
- Disabling or isolating dynamic template features when they are not required
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that identify user-controlled data entering template compilation or PHP code-generation paths
- Code review checks for template markers, cache generation, and inheritance-state handling
- Tests that render attacker-controlled values through inheritance and cache regeneration flows
- Monitoring for unexpected modifications or newly generated PHP files in template cache directories
- File-integrity policies and runtime controls that restrict executable code in cache locations
- Automated security review tools that flag code-generation paths lacking context-aware validation
Organizations can look for this class of issue through:
- Static analysis rules that identify user-controlled data entering template compilation or PHP code-generation paths
- Code review checks for template markers, cache generation, and inheritance-state handling
- Tests that render attacker-controlled values through inheritance and cache regeneration flows
- Monitoring for unexpected modifications or newly generated PHP files in template cache directories
- File-integrity policies and runtime controls that restrict executable code in cache locations
- Automated security review tools that flag code-generation paths lacking context-aware validation
