CVE-2024-28861: 
PHP vulnerability analysis and mitigation

Symfony 1, a community-driven fork of the 1.x branch of Symfony PHP framework, contains a vulnerability in versions 1.1.0 through 1.5.18. The vulnerability exists due to dangerous deserialization in the sfNamespacedParameterHolder class that could enable remote code execution if a developer deserializes user input in their project. The issue was discovered and disclosed on March 22, 2024, and has been assigned CVE-2024-28861 with a CVSS v3.1 base score of 9.8 (CRITICAL) (GitHub Advisory).

The vulnerability stems from the uncontrolled deserialization of user input in the sfNamespacedParameterHolder class. When an instance of this class is deserialized, the unserialize() method is triggered, which makes an array access on the deserialized data without proper type checking. This allows an attacker to provide any object type in the data parameter to manipulate array/object properties through the ArrayAccess interface. The vulnerability specifically involves the sfOutputEscaperArrayDecorator class and can be exploited through a gadget chain to achieve remote code execution (GitHub Advisory).

If exploited, this vulnerability allows an attacker to execute arbitrary PHP commands, leading to remote code execution on the affected system. While the vulnerability presents no direct threat, it becomes a critical security risk when developers deserialize untrusted user input in their applications (GitHub Advisory).

The vulnerability can be exploited when a developer deserializes untrusted user input. A proof of concept exists demonstrating how an attacker can craft a malicious serialized object to achieve remote code execution through the sfOutputEscaperArrayDecorator class and the shell_exec function (GitHub Advisory).

The vulnerability has been patched in version 1.5.19. The fix implements type checking before processing unserialized input in both sfNamespacedParameterHolder and sfParameterHolder classes. Organizations using affected versions should upgrade to version 1.5.19 or later (GitHub Commit).