CVE-2017-9841: PHPUnit Command Injection Vulnerability
Last updated 18 December 2024
Other sources
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
— CISA
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a <?php substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/phpunitto a version that resolves this vulnerability.Fixed in 9.5.2-1Fixed in 9.6.7-1Fixed in 9.6.21-1 - Upgrade
Upgrade
composer/phpunit/phpunitto a version that resolves this vulnerability.Fixed in 5.6.3 - Upgrade
Upgrade
composer/phpunit/phpunitto a version that resolves this vulnerability.Fixed in 4.8.28 - Upgrade
Upgrade
debian/phpunitto a version that resolves this vulnerability.Fixed in 9.5.2-1 - Upgrade
Upgrade
debian/phpunitto a version that resolves this vulnerability.Fixed in 9.6.7-1 - Upgrade
Upgrade
debian/phpunitto a version that resolves this vulnerability.Fixed in 9.6.21-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9841?
CVE-2017-9841 has a high severity level due to the potential for remote code execution.
How do I fix CVE-2017-9841?
To fix CVE-2017-9841, upgrade PHPUnit to version 5.6.3 or 4.8.28.
What software is affected by CVE-2017-9841?
CVE-2017-9841 affects PHPUnit versions prior to 5.6.3 and 4.8.28.
Can CVE-2017-9841 be exploited remotely?
Yes, CVE-2017-9841 can be exploited remotely through crafted HTTP POST requests.
What are the impacts of exploiting CVE-2017-9841?
Exploiting CVE-2017-9841 allows attackers to execute arbitrary PHP code on the server.