PT-2024-22609 · Symfony+1 · Symfony1+1

Darkpills · Published 2024-03-15 · Updated 2024-03-18 · CVE-2024-28859

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symfony1 versions 1.3.0 through 1.5.17

Description This issue is related to a gadget chain in Symfony1 due to a vulnerable Swift Mailer dependency. The vulnerability allows an attacker to achieve remote code execution if a developer unserializes user input in their project. It presents no direct threat but can enable remote code execution if a developer deserializes untrusted data. Symfony1 depends on Swift Mailer, which is bundled by default in the vendor directory since version 1.3.0. Swift Mailer classes implement destruct() methods, which can be exploited to access array or object properties not intended by the developer. This can lead to the execution of any PHP command, resulting in remote code execution. The issue has been addressed in version 1.5.18.

Recommendations For Symfony1 versions 1.3.0 through 1.5.17, update to version 1.5.18 or higher to resolve the issue. If using composer, ensure that the Swift Mailer version is updated to 6.2.5 or higher. Alternatively, if Symfony 1.5 needs Swift 5.x, consider forking Swift Mailer and cherry-picking the commit that fixes the vulnerability. As a temporary workaround, consider avoiding the deserialization of user input in projects until a patch is applied.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-28859

GHSA-WJV8-PXR6-5F4R

Affected Products

Swiftmailer

Symfony1

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28859.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony1/swiftmailer/CVE-2024-28859.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/swiftmailer/swiftmailer/CVE-2024-28859.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony1/symfony1/CVE-2024-28859.yaml · Exploit
• https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28859 · Security Note
• https://osv.dev/vulnerability/GHSA-wjv8-pxr6-5f4r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28859 · Vendor Advisory
• https://github.com/FriendsOfSymfony1/symfony1/commit/edb850f94fb4de18ca53d0d1824910d6e8130166 · Note
• https://github.com/FriendsOfSymfony1/symfony1 · Note
• https://t.me/cvenotify/73996 · Telegram Post
• https://twitter.com/CVEnew/status/1768769209050243438 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1768798589940088990 · Twitter Post