PHPUnit eval-stdin.php RCE

Product: Sebastian Bergmann PHPUnit
CVE: CVE-2017-9841
Disclosed: 2017-06-27
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: < 4.8.28, 5.x < 5.6.3
Fixed: 4.8.28, 5.6.3

Summary

PHPUnit shipped a helper script that evals whatever PHP code is POSTed to it. Sites that deploy their composer /vendor directory into the web root expose it directly, and it remains one of the most heavily scanned URLs on the internet years later.

Root cause

src/Util/PHP/eval-stdin.php executed eval('?>'.file_get_contents('php://input')), intended for CLI use with stdin. Under a web server, php://input is the HTTP request body, so any POST beginning with '<?php' is executed.

Impact

Unauthenticated RCE on any site exposing vendor/phpunit (often via bundled CMS plugins/themes).

Public PoC

curl -s --data '<?php echo md5("phpunit"); system("id");' \
  http://target/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

Source: vulhub / phpunit/CVE-2017-9841

Detection

Search logs for '/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php'. nuclei template CVE-2017-9841.

Mitigation

Upgrade PHPUnit, remove dev dependencies from production (composer install --no-dev), and block web access to /vendor.