CVE-2024-28859: 
PHP vulnerability analysis and mitigation

Symfony1, a community fork of symfony 1.4, contains a vulnerability (CVE-2024-28859) in versions 1.3.0 to 1.5.17-master that enables remote code execution through a gadget chain in the Swift Mailer dependency. The vulnerability was discovered on March 15, 2024, and affects installations where developers unserialize untrusted user input (GitHub Advisory).

The vulnerability stems from Swift Mailer classes implementing __destruct() methods that can be exploited when PHP destroys objects in memory. An attacker can manipulate $this->_keys to access unintended array/object properties, particularly exploiting classes implementing the ArrayAccess interface. The vulnerability has a CVSS v3.1 score of 5.0 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L (NVD).

When exploited, the vulnerability allows attackers to execute arbitrary PHP commands leading to remote code execution. While the vulnerability presents no direct threat, it becomes dangerous when developers unserialize untrusted user data in their projects (GitHub Advisory).

The vulnerability requires a Symfony1 installation where developers unserialize user input in their code. The exploit leverages the Swift Mailer dependency, which is bundled by default in the vendor directory since version 1.3.0. A proof-of-concept exploit exists that demonstrates the ability to execute system commands through carefully crafted serialized objects (GitHub Advisory).

The vulnerability has been patched in version 1.5.18. Users are strongly advised to upgrade to this version. For installations using composer, updating to the latest version will automatically include the patched version of Swift Mailer (6.2.5 or higher) which contains the necessary security fixes (GitHub Advisory).