CVE-2024-28859: Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency
Summary
CVE-2024-28859: Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency. Affects friendsofsymfony1/symfony1 versions >= 1.3.0, < 1.5.18. Fixed in 1.5.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony 1 is a PHP web application framework that allows developers to build web applications quickly and efficiently. It relies on various dependencies, including Swift Mailer, which is bundled by default in the vendor directory. Swift Mailer is a popular library for sending emails in PHP. However, versions of Symfony 1 prior to 1.5.13 are vulnerable to a gadget chain due to a vulnerable Swift Mailer dependency.
Vulnerability Detail
The vulnerability in Symfony 1 arises from the insecure deserialization of user input. If a developer uses the unserialize function on untrusted data, it can lead to remote code execution. The vulnerable Swift Mailer classes, such as Swift_KeyCache_DiskKeyCache, have a __destruct() method that can be abused to access unintended properties or trigger arbitrary code execution. This can be further exploited through the sfOutputEscaperArrayDecorator class, which implements the ArrayAccess interface and allows an attacker to execute PHP commands. The vulnerability is present in Symfony 1 versions prior to 1.5.13.
How To Fix
Minimum fixed version
1.5.18
This is the first release that contains the fix.
composer require friendsofsymfony1/symfony1:1.5.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can avoid using the unserialize function on untrusted data. Instead, consider using alternative methods for data handling and validation to prevent the exploitation of this vulnerability.
Conclusion
The vulnerability in Symfony 1 due to a vulnerable Swift Mailer dependency can lead to remote code execution if user input is deserialized without proper validation. It is crucial to update Symfony 1 to a version that includes the fix and to validate and sanitize user input before performing any deserialization operations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for friendsofsymfony1/symfony1 →
FAQ
Symfony 1 is a PHP web application framework that allows developers to build web applications quickly and efficiently.
Swift Mailer is a popular library for sending emails in PHP.
The vulnerability arises from the insecure deserialization of user input, which can lead to remote code execution.
Versions of Symfony 1 prior to 1.5.13 are affected by this vulnerability.
To fix this vulnerability, update the Symfony 1 installation to version 1.5.18 or higher and ensure that user input is properly validated and sanitized.
References
Related vulnerabilities
Recent vulnerabilities recorded for friendsofsymfony1/symfony1.
