CVE-2024-28859
Published: 15 March 2024
Summary
CVE-2024-28859 is a medium-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Friendsofsymfony1 Symfony1. Its CVSS base score is 5.0 (Medium).
Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Symfony1, a community-maintained fork of the legacy symfony 1.4 framework, contains a deserialization gadget chain originating from its bundled Swift Mailer dependency. The issue stems from Swift Mailer classes that implement __destruct methods and expose an array-access pattern via a _keys property; when an attacker supplies a crafted serialized object that implements ArrayAccess, PHP can be induced to access unintended properties during object destruction, ultimately permitting arbitrary command execution. The vulnerability is tracked as CWE-502 and affects all versions prior to 1.5.18; it carries a CVSS 3.1 score of 5.0 reflecting the need for an authenticated user to trigger untrusted deserialization.
An attacker with the ability to supply serialized data to an application that performs unserialize on that input can leverage the chain to obtain remote code execution. The attack requires the target project to deserialize attacker-controlled data and therefore does not affect applications that avoid this pattern, but it provides a reliable vector once that precondition is met.
The project security advisory and accompanying commit on the FriendsOfSymfony1 repository state that the issue has been resolved in Symfony1 1.5.18; administrators are advised to upgrade, and the maintainers note that no workarounds exist.
EPSS remains low and unchanged at 0.0511 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1026
Vulnerability details
Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to…
more
get remote code execution if a developer unserialize user input in his project. This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. Symfony 1 depends on Swift Mailer which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer classes implement some `__destruct()` methods. These methods are called when php destroys the object in memory. However, it is possible to include any object type in `$this->_keys` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface. This may allow an attacker to execute any PHP command which leads to remote code execution. This issue has been addressed in version 1.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.