Server-Side Template Injection in Thelia 3.0.0

Executive Summary

This is a server-side template injection (SSTI) flaw in Thelia 3.0.0's back-office Email/Messages feature. It allows authenticated users with the Messages permission to inject unsandboxed Twig templates. These templates are compiled and executed as raw code, enabling arbitrary PHP function execution, file reads, and potential filesystem writes.

Useful 0 Not Useful 0

Detection Guidance

Check Thelia installations for the vulnerable Email/Messages feature. Look for unsandboxed Twig template usage in message content. Verify if thelia/twig-engine-module version is below 1.0.9. Inspect server logs for unusual PHP function execution or file access patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server, read sensitive files, or modify system files. This could lead to full application compromise, data theft, or system takeover. The impact depends on the server's configuration and permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules. A breach could result in legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update thelia/twig-engine-module to version 1.0.9 or later immediately. Restrict the 'Messages' permission to trusted users only. Review and sanitize all message content for suspicious Twig template syntax. Monitor filesystem and application logs for signs of exploitation.

Useful 0 Not Useful 0