PHPUnit · PHPUnit
The flaw is in the eval-stdin.php component of PHPUnit (Util/PHP/eval-stdin.php) in versions before 4.8.28 and 5.x before 5.6.3, which fails to control generation of code. An unauthenticated remote attacker can execute arbitrary PHP code by sending HTTP POST data beginning with a "<?php " substring, which is practical where the /vendor folder, and this file within it, is exposed to external access.
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
First seen exploited 3 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 3 years after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Arbitrary PHP code execution on the server
allows remote attackers to execute arbitrary PHP code
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: phpunit/phpunit.
Upgrade to 5.6.3 or later
Set the version to 5.6.3 or later in your composer.json.
The first fix for CVE-2017-9841. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 5.0.10 up to 5.6.3 | 5.6.3 |
| 4.8.19 up to 4.8.28 | 4.8.28 |
“Up to” means the second version is the fix and is not affected.
Reports are matched by finding the exact id CVE-2017-9841 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…vulnerability (identified as CVE-2017-9841) allowed attackers to open a reverse shell on port…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.