CVE-2017-9841 PHPUnit Command Injection
Remote attackers can execute arbitrary PHP code if the PHPUnit eval-stdin.php file is exposed via HTTP POST requests.
- Exploited in the wild
- Since 15 Feb 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9841?
CVE-2017-9841 is a critical code injection vulnerability in Oracle Communications Diameter Signaling Router, published on 27 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Weakness: CWE-94
Which versions are affected by CVE-2017-9841?
4 open source packages ship an affected version, including phpunit/phpunit. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
phpunit/phpunit Packagist | From 4.8.19 | 4.8.28 |
phpunit/phpunit Packagist | From 4.8.19 | 4.8.28 |
phpunit/phpunit Packagist | From 5.0.10 | 5.6.3 |
phpunit/phpunit Packagist | From 5.0.10 | 5.6.3 |
Products include Oracle Communications Diameter Signaling Router, Phpunit Project Phpunit.
How do I fix CVE-2017-9841?
Upgrade phpunit/phpunit to a fixed version for your release line: 4.8.28 or 5.6.3. US federal agencies must fix it by 15 Aug 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-9841 being exploited?
Yes. Attackers have exploited CVE-2017-9841 in the wild since at least 15 Feb 2022.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 18 proofs of concept on GitHub.
Other vulnerabilities in Oracle Communications Diameter Signaling Router
- CVE-2019-2729 Auth bypass in WebLogic Server
- CVE-2019-2399 Information disclosure in Communications Diameter Signaling Router (DSR)
- CVE-2020-14788 Cross-site scripting in Communications Diameter Signaling Router (DSR)
- CVE-2020-14787 Cross-site scripting in Communications Diameter Signaling Router (DSR)
All Oracle Communications Diameter Signaling Router vulnerabilities
Sources
Also known as DEBIAN-CVE-2017-9841, GHSA-r7c9-c69m-rph8, UBUNTU-CVE-2017-9841, USN-7171-1.