UnratedPackagistPublished
Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder
CVE-2024-28861 · GHSA-pv9j-c53q-h433
- Affected
- Packagist friendsofsymfony1/symfony1 >= 1.1.0, < 1.5.19
- Fixed in
- 1.5.19· Vendor fix available
- Issue
- Symfony 1 has a gadget chain due to dangerous unserialize in sfNamespacedParameterHolder class that would enable an attacker to get remote code execution if a developer unserialize user input in his project. Details This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. For example: We will make the assumption this is the case in the rest of this explanation. Symfony 1 provides the class sfNamespacedParameterHolder which implements Serializable interface. In particular, when an instance of this class is deserialized, the normal php behavior is hooked by implementing unserialize() method: Which make an array access on the deserialized data without control on the type of the $data parameter: Thus, an attacker provide any object type in $data to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which…
Recommended action: Upgrade to 1.5.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.