GHSA-8cfw-pcwh-v63w: Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox (“safe mode”) that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modify arbitrary database records, execute arbitrary SQL (including DDL such as DROP TABLE), exfiltrate sensitive data such as backend administrator credentials, and achieve remote code execution by injecting PHP into a CMS page, layout, or partial code section:

• cms.manage_pages
• cms.manage_layouts
• cms.manage_partials

This is an incomplete-fix follow-up to CVE-2024-54149 (GHSA-xhw3-4j3m-hq53). That fix added a blocklist of dangerous methods to System\Twig\SecurityPolicy, but the blocklist missed a large number of equivalent methods and did not account for the way Eloquent models forward calls to the query builder. As a result the sandbox could be bypassed through — among others — saveQuietly()/deleteQuietly(), increment()/decrement(), newQuery(), getConnection(), getConnectionResolver(), relation and pivot methods, and higher-order collection methods that execute callables.

To actively exploit this issue, an attacker would need an authenticated backend account with one of the permissions listed above. These permissions are intended for trusted developers/administrators, and the sandbox is the additional protection layer this advisory is concerned with.