CVE-2024-28861 Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder
An attacker can achieve remote code execution if a developer deserializes untrusted user input using the sfNamespacedParameterHolder class in Symfony 1.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28861?
CVE-2024-28861 is a critical unsafe deserialization vulnerability in FriendsOfSymfony1 symfony1, published on 22 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.
Weakness: CWE-502
Which versions are affected by CVE-2024-28861?
2 open source packages ship an affected version, including friendsofsymfony1/symfony1. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
friendsofsymfony1/symfony1 Packagist | From 1.1.0 | 1.5.19 |
friendsofsymfony1/symfony1 Packagist | From 1.1.0 | 1.5.19 |
Products include Friendsofsymfony1 Symfony1.
How do I fix CVE-2024-28861?
Upgrade friendsofsymfony1/symfony1 to 1.5.19 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-28861 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28861 exists.
Other vulnerabilities in FriendsOfSymfony1 symfony1
Sources
Also known as GHSA-pv9j-c53q-h433.