阿里云漏洞库

New Digital Group Smarty是New Digital Group公司的的一款使用PHP语言编写的模板引擎。

New Digital Group Smarty 3.1.33之前版本中的‘Smarty_Security::isTrustedResourceDir()’函数存在路径遍历漏洞，该漏洞源于程序未能对模板代码充分过滤。攻击者可通过控制被执行的模板代码利用该漏洞绕过可信目录安全限制并读取任意文件。

厂商已发布漏洞修复程序，请及时关注更新：
https://github.com/smarty-php/smarty/commit/f9ca3c63d1250bb56b2bda609dcc9dd81f0065f8

参考链接
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180420-0...
https://github.com/smarty-php/smarty/commit/2e081a51b1effddb23f87952959139ac62654d50
https://github.com/smarty-php/smarty/commit/8d21f38dc35c4cd6b31c2f23fc9b8e5adbc56dfe
https://github.com/smarty-php/smarty/commit/bcedfd6b58bed4a7366336979ebaa5a240581531
https://github.com/smarty-php/smarty/commit/c9dbe1d08c081912d02bd851d1d1b6388f6133d1
https://github.com/smarty-php/smarty/commit/f9ca3c63d1250bb56b2bda609dcc9dd81f0065f8
https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00015.html

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	smarty	smarty	*		Up to (excluding) 3.1.33
	运行在以下环境
	系统	debian_10	smarty3	*		Up to (excluding) 3.1.33+20180830.1.3a78a21f+selfpack1-1
	运行在以下环境
	系统	debian_11	smarty3	*		Up to (excluding) 3.1.33+20180830.1.3a78a21f+selfpack1-1
	运行在以下环境
	系统	debian_12	smarty3	*		Up to (excluding) 3.1.33+20180830.1.3a78a21f+selfpack1-1
	运行在以下环境
	系统	fedora_28	php-Smarty	*		Up to (excluding) 3.1.33-1.fc28
	运行在以下环境
	系统	fedora_29	php-Smarty	*		Up to (excluding) 3.1.33-1.fc29
	运行在以下环境
	系统	fedora_EPEL_7	php-Smarty	*		Up to (excluding) 3.1.33-1.el7
	运行在以下环境
	系统	ubuntu_18.04	smarty3	*		Up to (excluding) 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1

CWE-ID	漏洞类型
CWE-22	对路径名的限制不恰当（路径遍历）