Code Injection in Smarty - CVE-2022-29221

Vulnerability identifier: #VU63344

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29221

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to improper input validation when processing block name or include file name. A remote attacker can send a specially crafted request and execute arbitrary PHP code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Smarty
Gentoo Linux
Fedora
Ubuntu
postfixadmin (Ubuntu package)
smarty3 (Debian package)
smarty3 (Ubuntu package)
php-Smarty
dev-php/smarty

Install updates from vendor's website.

Smarty - addressed in versions 3.1.45, 4.1.1
postfixadmin (Ubuntu package) - update to Ubuntu Pro
smarty3 (Debian package) - addressed in versions 3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u1, 3.1.39-2+deb11u1
smarty3 (Ubuntu package) - addressed in versions 3.1.39-2ubuntu1.22.04.1, 3.1.39-2ubuntu1.22.10.1
php-Smarty - addressed in versions 3.1.47-1.el7, 3.1.47-1.fc36, 3.1.47-1.fc37
dev-php/smarty - update to 4.2.1

• Exploit #7892 - CVE-2022-29221-PoC (CVE-2022-29221 Proof of Concept Code - Smarty RCE) (May 26, 2022)

• https://github.com/smarty-php/smarty/releases/tag/v3.1.45
• https://github.com/smarty-php/smarty/releases/tag/v4.1.1
• https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c

• Remote code execution in Smarty
• Debian update for smarty3
• Gentoo update for Smarty
• Ubuntu update for smarty3
• Ubuntu update for postfixadmin
• Fedora EPEL 7 update for php-Smarty
• Fedora 36 update for php-Smarty
• Fedora 37 update for php-Smarty