Access Control: Twig PHP \<2.4.4 template engine - SSTI¶

Identifier: twig_php_ssti

Scanner(s) Support¶

Description¶

A vulnerability in Twig PHP allows remote attackers to cause the product to execute arbitrary commands via an SSTI vulnerability.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  twig_php_ssti:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.