CVE-2024-28859
Deserialization in Friendsofsymfony1 Symfony1 1.3.0 – 1.5.18
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-28859 is a medium-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Friendsofsymfony1 Symfony1. Its CVSS base score is 5.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 26% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Symfony1, a community-maintained fork of the legacy symfony 1.4 framework, contains a deserialization gadget chain originating from its bundled Swift Mailer dependency. The issue stems from Swift Mailer classes that implement __destruct methods and expose an array-access pattern via a _keys property; when an attacker supplies a crafted serialized object that implements ArrayAccess, PHP can be induced to access unintended properties during object destruction, ultimately permitting arbitrary command execution. The vulnerability is tracked as CWE-502 and affects all versions prior to 1.5.18; it carries a CVSS 3.1 score of 5.0 reflecting the need for an authenticated user to trigger untrusted deserialization.
An attacker with the ability to supply serialized data to an application that performs unserialize on that input can leverage the chain to obtain remote code execution. The attack requires the target project to deserialize attacker-controlled data and therefore does not affect applications that avoid this pattern, but it provides a reliable vector once that precondition is met.
The project security advisory and accompanying commit on the FriendsOfSymfony1 repository state that the issue has been resolved in Symfony1 1.5.18; administrators are advised to upgrade, and the maintainers note that no workarounds exist.
EPSS remains low and unchanged at 0.0511 with no observed increase after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1026
Vulnerability Data
Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to…
more
get remote code execution if a developer unserialize user input in his project. This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. Symfony 1 depends on Swift Mailer which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer classes implement some `__destruct()` methods. These methods are called when php destroys the object in memory. However, it is possible to include any object type in `$this->_keys` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface. This may allow an attacker to execute any PHP command which leads to remote code execution. This issue has been addressed in version 1.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can uncover deserialization flaws before deployment.
Input validation directly stops deserialization of untrusted data by ensuring inputs are valid before processing.
Engineering principles such as safe deserialization and input sanitization structurally prevent the weakness from being introduced.
Integrity verification tools can detect malformed or tampered serialized data after the fact.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.