CVE-2024-35191 (PHP, published 2024-05-20T21:15Z)
Description: value: Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text.  This has been fixed in Formie 2.1.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/verbb/formie
Files changed:
src/base/PluginTrait.php
src/base/Webhook.php
src/controllers/FormsController.php
src/controllers/SubmissionsController.php
src/elements/Submission.php
src/fields/formfields/Hidden.php
src/gql/resolvers/mutations/SubmissionResolver.php
src/helpers/Variables.php
src/services/Emails.php
src/services/Rendering.php
Commit message: Change all instances of dynamic Twig to use safe, sandboxed environment to protect against potential security issues


Vulnerable code:
        $url = Craft::$app->getView()->renderObjectTemplate($url, $submission);
            $url = Craft::$app->getView()->renderObjectTemplate($url, $form);
                $url = $this->getView()->renderObjectTemplate($settings->pageRedirectUrl, $submission);
        $redirectUrl = Craft::$app->getView()->renderObjectTemplate($redirect, $submission);
        // Prevent users using long-hand Twig `{{` to prevent injection execution
        $submissionTitleFormat = str_replace(['{{', '}}'], ['', ''], $form->settings->submissionTitleFormat);

        $submission->title = Variables::getParsedValue($submissionTitleFormat, $submission, $form);
        // Prevent users using long-hand Twig `{{` to prevent injection execution
        $submissionTitleFormat = str_replace(['{{', '}}'], ['', ''], $form->settings->submissionTitleFormat);

        if ($customTitle = Variables::getParsedValue($submissionTitleFormat, $this, $form)) {
            // Prevent users using long-hand Twig `{{` to prevent injection execution
            $value = str_replace(['{{', '}}'], ['{', '}'], $value);
            // Prevent users using long-hand Twig `{{` to prevent injection execution
            $submissionTitleFormat = str_replace(['{{', '}}'], ['', ''], $settings->submissionTitleFormat);

            $submission->title = Variables::getParsedValue($submissionTitleFormat, $submission, $form);
        $view = Craft::$app->getView();

            return $view->renderObjectTemplate($value, $submission, $variables);
        $fileName = Craft::$app->getView()->renderObjectTemplate($filenameFormat, $variables);
                // Prevent users using long-hand Twig `{{` to prevent injection execution. Only an issue for 
                    $value = str_replace(['{{', '}}', '{%', '%}'], ['{', '}', '', ''], $value);

Fixed code:
use verbb\base\services\Templates;
    public function getTemplates(): Templates
    {
        return $this->get('templates');
    }

            'templates' => [
                'class' => Templates::class,
                'pluginClass' => Formie::class,
            ],
use verbb\formie\Formie;
        $url = Formie::$plugin->getTemplates()->renderObjectTemplate($url, $submission);
            $url = Formie::$plugin->getTemplates()->renderObjectTemplate($url, $form);
                $url = Formie::$plugin->getTemplates()->renderObjectTemplate($settings->pageRedirectUrl, $submission);
        $redirectUrl = Formie::$plugin->getTemplates()->renderObjectTemplate($redirect, $submission);
        $submission->title = Variables::getParsedValue($form->settings->submissionTitleFormat, $submission, $form);
        if ($customTitle = Variables::getParsedValue($form->settings->submissionTitleFormat, $this, $form)) {
            $submission->title = Variables::getParsedValue($settings->submissionTitleFormat, $submission, $form);
            return Formie::$plugin->getTemplates()->renderObjectTemplate($value, $submission, $variables);
        $fileName = Formie::$plugin->getTemplates()->renderObjectTemplate($filenameFormat, $variables);
                // Ensure that we protect against developers using Twig to populate values from query strings
                    $value = Formie::$plugin->getTemplates()->renderString($value);