CVE-2024-28861: Remote Code Execution in friendsofsymfony1/symfony1
Summary
CVE-2024-28861: Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder. Affects friendsofsymfony1/symfony1 versions >= 1.1.0, < 1.5.19. Fixed in 1.5.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
friendsofsymfony1/symfony1 is a package in the Packagist ecosystem. It is a PHP framework that provides a set of reusable components and tools for building web applications. The package includes the sfNamespacedParameterHolder class, which implements the Serializable interface. This class is vulnerable to a gadget chain due to dangerous unserialize, which can lead to remote code execution if a developer unserializes user input in their project.
Vulnerability Detail
The vulnerability in sfNamespacedParameterHolder arises from the uncontrolled unserialization of user input. When an instance of this class is deserialized, the unserialize() method is called, which in turn triggers an array access on the deserialized data without proper type checking. This allows an attacker to provide an object type in the deserialized data, leading to unintended access to array/object properties. By exploiting this, an attacker can execute arbitrary PHP commands, potentially resulting in remote code execution.
How To Fix
Minimum fixed version
1.5.19
This is the first release that contains the fix.
composer require friendsofsymfony1/symfony1:1.5.19Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can avoid using unserialize() on untrusted user input. Instead, they should consider alternative methods for handling user input, such as using JSON or XML parsing libraries that provide built-in security measures against code execution.
Conclusion
In conclusion, the friendsofsymfony1/symfony1 package is vulnerable to remote code execution due to uncontrolled unserialization. Developers should apply the recommended fix by adding type checking to the unserialize() method. Additionally, they should avoid using unserialize() on untrusted user input and consider alternative methods for handling user input. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for friendsofsymfony1/symfony1 →
FAQ
The vulnerability allows an attacker to execute arbitrary PHP commands, potentially leading to remote code execution.
Versions 1.1.0 to 1.5.18 of friendsofsymfony1/symfony1 are affected by this vulnerability.
No, CVSS score is not applicable to this kind of vulnerability.
There are no known exploits for this vulnerability at the moment.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for friendsofsymfony1/symfony1.
