GHSA-8CFW-PCWH-V63W: Authenticated Twig Sandbox Escape and Remote Code Execution in Winter CMS

Winter CMS is a content management system built on the Laravel framework. It provides backend administrators with the ability to edit templates, layouts, and partials directly from the CMS administrative interface. To prevent administrative users from executing arbitrary code on the hosting server, Winter CMS employs a sandboxed Twig environment for compiling and executing user-supplied templates.

The Twig sandbox model restricts access to specific functions, filters, and methods defined by the system's security policy. However, when database models, query builders, or collection structures are passed into the Twig execution context, administrative users can access underlying object graphs. This creates an attack surface where methods on these exposed objects can be invoked directly from within a sandboxed template.

The vulnerability tracked as GHSA-8CFW-PCWH-V63W constitutes a complete sandbox escape and remote code execution bypass. It arises due to incomplete coverage in the blocklist implementation introduced during the remediation of CVE-2024-54149. An authenticated attacker with privileges to modify layouts, pages, or partials can bypass the security policy to run arbitrary PHP code under the context of the web server process.

Before analyzing the bypass mechanisms, it is essential to review the original vulnerability, CVE-2024-54149, and its corresponding remediation. In previous versions, any database models or datasource objects passed into the template context were passed by reference. Because templates retained access to active record methods, a template designer could perform database mutation operations.

To address this, the developer implemented a security patch in commit fb88e6fabde3b3278ce1844e581c87dcf7daee22. This fix registered a flat class-specific blocklist in the System\Twig\SecurityPolicy component. The blocklist targeted critical classes, including Controller, DbModel, HalcyonModel, and DatasourceInterface.

The policy prevented the direct invocation of hazardous methods such as save, update, delete, and forceDelete on these classes. While this approach stopped simple mutation attempts, it relied on a static class-to-method matching paradigm. The system evaluated the class of the current object and checked if the requested method name matched the hardcoded blocklist, failing to account for dynamic method forwarding and runtime type modifications.

The root cause of GHSA-8CFW-PCWH-V63W resides in four distinct structural bypasses of the static blocklist mechanism in the SecurityPolicy class.

First, the blocklist is bypassed through dynamic __call forwarding. Winter CMS Storm models utilize PHP magic methods to delegate unresolved method calls. When a template calls a method not explicitly present on the model, the model forwards the request to the underlying EloquentBuilder or QueryBuilder. Because the static policy only inspected the class of the model and its immediate blocklist, an attacker could invoke methods like saveQuietly or increment which bypassed the restriction on save or update by delegating directly to the builder classes.

Second, the policy failed to validate method arguments when processing higher-order collection methods. Laravel and Winter CMS collections expose methods such as map or filter that accept callables. Since the Twig engine only verified that the method name map was permitted on the collection class, an attacker could pass a dangerous PHP function name as an argument. The template engine would execute the callable on each item in the collection, leading to arbitrary code execution.

Third, static helper methods within the extension traits, such as extendableExtendCallback and extensionExtendCallback, provided a vector for second-order callable injection. Fourth, the template representation using Halcyon Models allowed attackers to query and update CMS page structures dynamically. By chaining queries through the Halcyon Builder, a user could modify layout or page files to inject PHP code blocks, which would then be compiled and executed during subsequent page requests.

The remediation implemented in commit 725bbcda232466f7f71381c271c6916573d576e6 introduces three distinct defense layers: transitive forwarder chain evaluation, custom Abstract Syntax Tree node transformation, and safe proxy decorators.

To handle dynamic magic calls, the SecurityPolicy was updated with a transitive forwarder mapping. When checking if a method is allowed, the policy recursively traces the class hierarchy through defined forwarders such as DbModel to EloquentBuilder and then to QueryBuilder. If any target class in the forwarder chain blocks the method, execution is prevented.

To counter the callable injection vector in collections and paginators, the framework modifies how Twig attributes are accessed. During compilation, a custom node visitor named GetAttrAdjuster swaps out standard attribute nodes (GetAttrExpression) for a custom GetAttrNode. At runtime, this custom node routes all attribute reads through a static helper method that dynamically intercepts collections and wraps them inside protective proxy classes.

These proxy classes, SafeCollection and SafePaginator, intercept all dynamic calls. If a method accepts a callable parameter, the proxy scans and strips out dangerous function names before forwarding the call to the underlying collection. This architecture ensures that while safe collection manipulation remains operational, arbitrary command execution via callbacks is neutralized.

Exploitation of this vulnerability requires authenticated access to the backend CMS administrative panel with permissions to edit templates, layouts, or partials. An attacker leverages these permissions to embed malicious Twig syntax into a page layout and then triggers execution by requesting the affected page.

Verification of the vulnerability can be conducted using test vectors designed to evaluate sandbox restrictions. An active record state bypass test checks whether mutations like saveQuietly are blocked. A query forwarder escape test attempts to leverage connection resolvers or builder chaining to run unauthorized database queries. A collection RCE test verifies if passing string arguments to higher-order methods is blocked.

When a patched instance of Winter CMS (v1.2.13 or higher) encounters these test vectors, it immediately aborts template rendering. The system throws a SecurityNotAllowedMethodError or SecurityNotAllowedFunctionError exception, preventing code execution and database alteration.

The recommended remediation is to upgrade the wintercms/winter package immediately to version v1.2.13 or higher. This update replaces the flat blocklist strategy with the comprehensive AST node adjustment and proxy collection mechanism, neutralizing the sandbox escape pathways.

In environments where immediate upgrading is not possible, administrators should restrict backend access. Users should only be assigned the cms.manage_layouts, cms.manage_pages, or cms.manage_partials permissions if they are completely trusted. Additionally, file system permissions should be configured to prevent the web server from writing to the theme or storage directories where executable code is compiled.

Detection of exploitation attempts can be achieved by monitoring the application's system logs for specific Twig sandbox exceptions. The presence of unhandled SecurityNotAllowedMethodError or SecurityNotAllowedFunctionError messages in the log files indicates that a template attempted to invoke restricted methods or execute blocked PHP functions.