PHPUnit eval-stdin remote code execution

What it does

The file vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php reads the request body and passes it to eval(). If the vendor directory of a PHP application is web-accessible, any attacker can execute PHP code on the server.

PHPUnit is a development dependency and should never be deployed to production, yet it is routinely shipped inside WordPress plugins, Drupal modules and Composer-based applications.

This is one of the most scanned paths on the internet. Botnets probe hundreds of vendor path variations to find any accessible copy.

Remediation

1. Remove development dependencies from production builds: composer install --no-dev.
2. Deny web access to the vendor directory at the web server or application level.
3. Upgrade PHPUnit to 5.6.3 or later where it must remain installed.

Enumeration

Detection templates and scanners you can run to find exposed instances on your own attack surface.

$ nuclei -id CVE-2017-9841 -u https://TARGET

Exploitation

Working exploit modules and public PoCs. Use only against systems you own or are authorized to test.

$ git clone https://github.com/Chocapikk/CVE-2017-9841.git

References

• PHPUnit fix commitgithub.com
• NVD recordnvd.nist.gov
• CISA KEV entrywww.cisa.gov