Loading vulnerability…
Unauthenticated Remote Code Execution in PHPUnit
CVE-2017-9841 is a code injection vulnerability affecting PHPUnit versions before 4.8.28 and 5.x before 5.6.3. A vulnerable PHP evaluation utility reads HTTP request-body data and passes it to PHP's eval() function. When the utility is accessible through a PHP-enabled web server, an unauthenticated remote attacker can submit an HTTP POST body beginning with a PHP opening tag to execute arbitrary PHP code. Exposure commonly results from deploying development dependencies within a publicly accessible application directory, including copies bundled with third-party modules or plugins.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary PHP execution with the privileges of the server-side PHP process, compromising application confidentiality, integrity, and availability. Attackers can read accessible application secrets, modify files, deploy web shells and malware, and execute operating-system commands where permitted by the PHP environment. Observed exploitation includes credential theft, cryptomining, reverse-shell deployment, and botnet propagation. Root privileges and broader infrastructure compromise require additional permissions, vulnerabilities, or accessible credentials.
If you can’t patch tonight, do this now.
Deny external HTTP access to PHPUnit and dependency directories, particularly the vulnerable evaluation endpoint. Keep development dependencies outside the public document root or exclude them from production deployments. Use default-deny web access rules and vulnerability-specific IDS/IPS controls as defense in depth. Restrict PHP process privileges and segment workloads to limit post-exploitation impact.
Patch, then assume compromise.
Upgrade phpunit/phpunit to version 4.8.28 or later in the 4.8 branch, or version 5.6.3 or later in the 5.x branch; preferably migrate to a currently supported release. Inventory application, plugin, module, and container dependencies for embedded vulnerable copies. Remove unnecessary production development dependencies and verify that residual vulnerable eval-stdin.php files are removed, including those left after updates or uninstallations. If exploitation is suspected, investigate for web shells, malicious processes, and unauthorized scheduled tasks, and revoke exposed credentials.
11 exploits validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit; 3 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
143 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.