Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project. This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. Symfony 1 depends on Swift Mailer which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer classes implement some `__destruct()` methods. These methods are called when php destroys the object in memory. However, it is possible to include any object type in `$this->_keys` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface. This may allow an attacker to execute any PHP command which leads to remote code execution. This issue has been addressed in version 1.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FriendsOfSymfony1 | symfony1 | 1.3.0 to before 1.5.18 | 1.5.18 | Patch available | CNA |
| — | friendsofsymfony1/symfony1 (Packagist) | 1.3.0 to before 1.5.18 | 1.5.18 | Patch available | GHSA-wjv8-pxr6-5f4r |
| — | friendsofsymfony1/swiftmailer (Packagist) | 4.0.0 to before 5.4.13 | 5.4.13 | Patch available | GHSA-wjv8-pxr6-5f4r |
| — | friendsofsymfony1/swiftmailer (Packagist) | 6.0.0 to before 6.2.5 | 6.2.5 | Patch available | GHSA-wjv8-pxr6-5f4r |
| — | swiftmailer/swiftmailer (Packagist) | 4.0.0 to before 6.2.5 | 6.2.5 | Patch available | GHSA-wjv8-pxr6-5f4r |
- symfony1 VendorFriendsOfSymfony1 Affected 1.3.0 to before 1.5.18 Fixed in 1.5.18 Patch available CNA
- friendsofsymfony1/symfony1 (Packagist) Vendor— Affected 1.3.0 to before 1.5.18 Fixed in 1.5.18 Patch available GHSA-wjv8-pxr6-5f4r
- friendsofsymfony1/swiftmailer (Packagist) Vendor— Affected 4.0.0 to before 5.4.13 Fixed in 5.4.13 Patch available GHSA-wjv8-pxr6-5f4r
- friendsofsymfony1/swiftmailer (Packagist) Vendor— Affected 6.0.0 to before 6.2.5 Fixed in 6.2.5 Patch available GHSA-wjv8-pxr6-5f4r
- swiftmailer/swiftmailer (Packagist) Vendor— Affected 4.0.0 to before 6.2.5 Fixed in 6.2.5 Patch available GHSA-wjv8-pxr6-5f4r
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:friendsofsymfony1:symfony1:*:*:*:*:*:*:*:* | 1.3.0 to before 1.5.18 | Vulnerable | FriendsOfSymfony1 |
- cpe:2.3:a:friendsofsymfony1:symfony1:*:*:*:*:*:*:*:* Versions 1.3.0 to before 1.5.18 Vulnerable ·FriendsOfSymfony1
Remediation
- Fix · CNA symfony1 (FriendsOfSymfony1) Fixed in 1.5.18
- Fix · GHSA-wjv8-pxr6-5f4r friendsofsymfony1/symfony1 (Packagist) Fixed in 1.5.18 Advisory →
- Fix · GHSA-wjv8-pxr6-5f4r friendsofsymfony1/swiftmailer (Packagist) Fixed in 5.4.13 Advisory →
- Fix · GHSA-wjv8-pxr6-5f4r friendsofsymfony1/swiftmailer (Packagist) Fixed in 6.2.5 Advisory →
- Fix · GHSA-wjv8-pxr6-5f4r swiftmailer/swiftmailer (Packagist) Fixed in 6.2.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28859
- 2026-10-03 Alias added: GHSA-wjv8-pxr6-5f4r
References
Other 5
- https://github.com/FriendsOfSymfony1/symfony1/commit/edb850f94fb4de18ca53d0d1824910d6e8130166
- https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony1/swiftmailer/CVE-2024-28859.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony1/symfony1/CVE-2024-28859.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/swiftmailer/swiftmailer/CVE-2024-28859.yaml
- https://github.com/FriendsOfSymfony1/symfony1
More FriendsOfSymfony1 Symfony1 vulnerabilities
- TI-2024-19060 Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-28859 · CVE Program
- CVE-2024-28859 · NVD
- FIRST EPSS
- GHSA-wjv8-pxr6-5f4r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences