CVE-2017-9841 Code Injection in PHPUnit
CriticalCVSS 9.8
EPSS 100.0%
CISA KEV
added 2022-02-15 · due 2022-08-15
Exploited in the wild
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CISA Known Exploited Vulnerability
- Date added
- 2022-02-15
- Due date (FCEB)
- 2022-08-15
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpunit/phpunit(Packagist) | >= 4.8.19, < 4.8.28 | 4.8.28 |
| phpunit/phpunit(Packagist) | = 4.8.19 | No fix listed |
| phpunit/phpunit(Packagist) | = 4.8.20 | No fix listed |
| phpunit/phpunit(Packagist) | = 4.8.21 | No fix listed |
| phpunit/phpunit(Packagist) | = 4.8.22 | No fix listed |
| phpunit/phpunit(Packagist) | = 4.8.23 | No fix listed |
| phpunit/phpunit(Packagist) | = 4.8.24 | No fix listed |
| phpunit/phpunit(Packagist) | = 4.8.25 | No fix listed |
| phpunit/phpunit(Packagist) | = 4.8.26 | No fix listed |
| phpunit/phpunit(Packagist) | = 4.8.27 | No fix listed |
| phpunit/phpunit(Packagist) | >= 5.0.10, < 5.6.3 | 5.6.3 |
| phpunit/phpunit(Packagist) | = 5.0.10 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.1.0 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.1.1 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.1.2 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.1.3 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.1.4 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.1.5 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.1.6 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.1.7 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.0 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.1 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.10 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.11 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.12 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phpunit/phpunit(Packagist) | = 5.2.2 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.3 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.4 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.5 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.6 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.7 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.8 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.2.9 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.3.0 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.3.1 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.3.2 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.3.3 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.3.4 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.3.5 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.0 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.1 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.2 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.3 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.4 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.5 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.6 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.7 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.4.8 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.5.0 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.5.1 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.5.2 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.5.3 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.5.4 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.5.5 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.5.6 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.5.7 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.6.0 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.6.1 | No fix listed |
| phpunit/phpunit(Packagist) | = 5.6.2 | No fix listed |
| debian/phpunit(Debian:12) | < 5.4.6-2 | 5.4.6-2 |
| debian/phpunit(Debian:14) | < 5.4.6-2 | 5.4.6-2 |
| debian/phpunit(Debian:13) | < 5.4.6-2 | 5.4.6-2 |
| phpunit project phpunit | <= 4.8.27 | No fix listed |
| phpunit project phpunit | >= 5.0.0, < 5.6.3 | 5.6.3 |
| oracle communications diameter signaling router | >= 8.0.0, <= 8.5.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch
- github.com exploit
- github.com product
- GLSA-201711-15 third-party-advisory vendor-advisory
- www.cisa.gov government-resource us-government-resource
- www.oracle.com patch third-party-advisory
- web.archive.org third-party-advisory
- 101798 broken-link vdb-entry
- 1039812 broken-link vdb-entry
- Debian Security Tracker CVE-2017-9841 vendor-advisory
- bugs.debian.org issue-tracking
- github.com