Adding another Symfony 1.1 to 1.5 RCE gadget chain (CVE-2024-28861)

ambionics / phpggc

PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

https://ambionics.io/blog

Apache License 2.0

3.25k stars 502 forks source link

Adding another Symfony 1.1 to 1.5 RCE gadget chain (CVE-2024-28861) #184

Closed darkpills closed 7 months ago

darkpills commented 8 months ago

Adding another Symfony RCE gadget chain (CVE-2024-28861). This one is more powerful, since it covers all versions from 1.1 to 1.5, with no breaking changes. A release of Symfony 1.5 has been done today (1.5.19) with the fix.

Also added the CVE number for the previous Symfony/RCE/12 chain in the information.

cfreal commented 7 months ago

Hello darkpills,

Thanks!

Charles