9.8crit
CVE-2017-9841KEVin critical feed1 exploit
Code Injection in PHPUnit
Also known as GHSA-r7c9-c69m-rph8
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2022-02-15
EPSS
100.0%
percentile 100%
Public exploits
1
Exploit-DB
Summary
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Known exploited (CISA KEV)
- Added
- 4 y ago
- Due date
- 2022-08-15 (4 y ago)
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- PHPUnit / PHPUnit
- CISA name
- PHPUnit Command Injection Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction (EPSS)
100.00% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
Exploits and detections
- EDB-50702 PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated) · webapps · 2022-02-02
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | phpunit/phpunit | >=4.8.19, <4.8.28 >=5.0.10, <5.6.3 | 4.8.28 5.6.3 |
Classification
- Weakness
- CWE-94 Improper Control of Generation of Code
References
- securityfocus.com /bid/101798 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1039812 · vdb-entry, x_refsource_SECTRACK, x_transferred
- security.gentoo.org /glsa/201711-15 · vendor-advisory, x_refsource_GENTOO, x_transferred
- oracle.com /security-alerts/cpuoct2021.html · x_refsource_MISC, x_transferred
- github.com /sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5 · x_refsource_MISC, x_transferred
- github.com /sebastianbergmann/phpunit/pull/1956 · x_refsource_MISC, x_transferred
- web.archive.org /web/20170701212357/http://phpunit.vulnbusters.com/ · x_refsource_MISC, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841 · government-resource
- nvd.nist.gov /vuln/detail/CVE-2017-9841 · advisory
- github.com /sebastianbergmann/phpunit/pull/1955 · web
- github.com /sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412 · web
- github.com /FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml · web
- github.com /sebastianbergmann/phpunit · package
- web.archive.org /web/20170701212357/http://phpunit.vulnbusters.com · web
Sources
- CVE List: CVE-2017-9841
- GitHub Advisory: GHSA-r7c9-c69m-rph8
- NVD: CVE-2017-9841
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.