CVE-2024-28859

{"id": "CVE-2024-28859", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}]}, "published": "2024-03-15T23:15:08.117", "references": [{"url": "https://github.com/FriendsOfSymfony1/symfony1/commit/edb850f94fb4de18ca53d0d1824910d6e8130166", "source": "security-advisories@github.com"}, {"url": "https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r", "source": "security-advisories@github.com"}, {"url": "https://github.com/FriendsOfSymfony1/symfony1/commit/edb850f94fb4de18ca53d0d1824910d6e8130166", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project. This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. Symfony 1 depends on Swift Mailer which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer classes implement some `__destruct()` methods. These methods are called when php destroys the object in memory. However, it is possible to include any object type in `$this->_keys` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface. This may allow an attacker to execute any PHP command which leads to remote code execution. This issue has been addressed in version 1.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Symfony1 es una bifurcaci\u00f3n comunitaria de Symfony 1.4 con DIC, mejoras en los formularios, el \u00faltimo Swiftmailer, mejor rendimiento, compatible con compositor y soporte para PHP 8. Symfony 1 tiene una cadena de gadgets debido a la dependencia vulnerable de Swift Mailer que permitir\u00eda a un atacante obtener la ejecuci\u00f3n remota de c\u00f3digo si un desarrollador deserializa la entrada del usuario en su proyecto. Esta vulnerabilidad no presenta una amenaza directa, pero es un vector que permitir\u00e1 la ejecuci\u00f3n remota de c\u00f3digo si un desarrollador deserializa datos del usuario que no son de confianza. Symfony 1 depende de Swift Mailer, que se incluye de forma predeterminada en el directorio de proveedores en la instalaci\u00f3n predeterminada desde 1.3.0. Las clases de Swift Mailer implementan algunos m\u00e9todos `__destruct()`. Estos m\u00e9todos se llaman cuando php destruye el objeto en la memoria. Sin embargo, es posible incluir cualquier tipo de objeto en `$this->_keys` para que PHP acceda a otras propiedades de matriz/objeto distintas a las previstas por el desarrollador. En particular, es posible abusar del acceso a la matriz que se activa en foreach($this->_keys...) para cualquier clase que implemente la interfaz ArrayAccess. Esto puede permitir a un atacante ejecutar cualquier comando PHP que conduzca a la ejecuci\u00f3n remota de c\u00f3digo. Este problema se solucion\u00f3 en la versi\u00f3n 1.5.18. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2024-11-21T09:07:03.500", "sourceIdentifier": "security-advisories@github.com"}