Skip to content
COOEY

EXPOSURES › CVE-2017-9841

CVE-2017-9841

HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2022-02-15 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2017-9841 ↗
⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 78/100 rceexploited-in-wildunpatched

PHPUnit's eval-stdin.php file allowed remote attackers to execute arbitrary PHP code via HTTP POST data when the /vendor folder was exposed.

A remote code execution vulnerability in PHPUnit allowed attackers to execute arbitrary PHP code by sending HTTP POST data starting with a '<?php' substring to an exposed /vendor folder. DIB organizations must ensure PHPUnit and all dependencies are patched and that /vendor folders are not publicly accessible to prevent similar exploits. This failure highlights the risk of relying on unpatched open-source components and the importance of strict access controls on exposed directories.

Shame score — The vulnerability was actively exploited in the wild (KEV) and allowed remote code execution, indicating a severe and avoidable failure in securing a widely used testing framework.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

DESCRIPTION

PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.