CVE-2017-9841
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.8epss 100%
from disclosure to weapon923 days
Published on NVDJun 27
1st PoC+923d
CISA KEV+1694d
exploitation probability
100%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
33 public exploit(s)
Action required by CISAfederal deadline: 2022-08-15
Apply updates per vendor instructions.
Versions
Affected
composer/phpunit/phpunit >= 4.8.19, < 4.8.28; composer/phpunit/phpunit >= 5.0.10, < 5.6.3
Fixed in
composer/phpunit/phpunit 4.8.28; composer/phpunit/phpunit 5.6.3
Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 33
exploitdbwww.exploit-db.com/exploits/50702unverifiedgithubgithub.com/RandomRobbieBF/phpunit-brute★ 30githubgithub.com/incogbyte/laravel-phpunit-rce-masscaner★ 23githubgithub.com/Chocapikk/CVE-2017-9841★ 7githubgithub.com/ludy-dev/PHPUnit_eval-stdin_RCE★ 6githubgithub.com/K3ysTr0K3R/CVE-2017-9841-EXPLOIT★ 6githubgithub.com/MadExploits/PHPunit-Exploit★ 5githubgithub.com/drcrypterdotru/PHPUnit-GoScan★ 4githubgithub.com/MrG3P5/CVE-2017-9841★ 4githubgithub.com/akr3ch/CVE-2017-9841★ 3githubgithub.com/p1ckzi/CVE-2017-9841★ 3githubgithub.com/dream434/CVE-2017-9841★ 1githubgithub.com/joelindra/CVE-2017-9841★ 1githubgithub.com/mbrasile/CVE-2017-9841★ 0githubgithub.com/cyberharsh/Php-unit-CVE-2017-9841★ 0githubgithub.com/jax7sec/CVE-2017-9841★ 0githubgithub.com/mileticluka1/eval-stdin★ 0githubgithub.com/MR-LeonardoGomes/CVE-2017-9841★ 0githubgithub.com/krisdewa/CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC★ 0vulncheckvulncheck.com/xdb/6435c08ede60unverifiedvulncheckvulncheck.com/xdb/2e43500dd68aunverifiedvulncheckvulncheck.com/xdb/0ca48238fb60unverifiedvulncheckvulncheck.com/xdb/2f94822ef64aunverifiedvulncheckvulncheck.com/xdb/7d5cdaa33e78unverifiedvulncheckvulncheck.com/xdb/487df0327bceunverifiedvulncheckvulncheck.com/xdb/8e4c8dfc7380unverifiedvulncheckvulncheck.com/xdb/f2c6ac384408unverifiedvulncheckvulncheck.com/xdb/f2a50a4ad68funverifiedvulncheckvulncheck.com/xdb/7a39231796b7unverifiedvulncheckvulncheck.com/xdb/dc847405f88eunverifiedvulncheckvulncheck.com/xdb/42d8d075303funverifiedvulncheckvulncheck.com/xdb/519ed136afcfunverifiedvulncheckvulncheck.com/xdb/e74331211046unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5https://github.com/sebastianbergmann/phpunit/pull/1956https://security.gentoo.org/glsa/201711-15https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841https://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/http://www.securityfocus.com/bid/101798http://www.securitytracker.com/id/1039812