Winter CMS Twig Sandbox Escape Vulnerability

Winter CMS contains a sandbox escape vulnerability within its Twig template security policy, resulting from an incomplete fix for CVE-2024-54149. This vulnerability allows authenticated backend users possessing specific CMS template-editing permissions (cms.manage_pages, cms.manage_layouts, or cms.manage_partials) to escape the Twig "safe mode" sandbox. The flaw exists because the existing security blocklist in System\Twig\SecurityPolicy failed to account for recursive method forwarding in Eloquent models and query builders. By leveraging methods like saveQuietly, increment, or getConnection, an attacker can manipulate database records, execute arbitrary SQL, or achieve remote code execution by injecting PHP into CMS templates. The issue is addressed in Winter CMS v1.2.13.

Impact

Successful exploitation allows an authenticated user to escalate privileges or gain remote code execution within the context of the web application. Attackers can perform unauthorized database operations, including dropping tables, modifying administrative credentials, or executing arbitrary system-level code if the server configuration permits. This affects all users running vulnerable versions of the system module prior to v1.2.13.

Recommendation

• Upgrade to Winter CMS v1.2.13 or later immediately to patch the SecurityPolicy logic.
• Clear the compiled Twig template cache using "php artisan cache:clear" after upgrading to ensure the new security policy is applied to existing templates.
• Audit and restrict administrative permissions for "cms.manage_pages", "cms.manage_layouts", and "cms.manage_partials" to trusted users only, as these are prerequisites for exploiting this vulnerability.