# CVE-2017-9841: PHPUnit - RCE

> Live exploitation tracking for CVE-2017-9841 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2017-9841

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** PHPUnit
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** php

## Description

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

## CrowdSec analysis

[CVE-2017-9841](https://euvd.enisa.europa.eu/vulnerability/CVE-2017-9841) is a critical vulnerability in PHPUnit that allows remote attackers to execute arbitrary PHP code by accessing a test script inadvertently left exposed in web-accessible locations.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2017-9841 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2017-9841 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2017-9841 is currently experiencing high visibility and active exploitation across the internet.

Attack attempts are characterized by requests to URLs ending in `/vendor/phpunit/phpunit/src/util/php/eval-stdin.php`.

## Timeline

- 2017-06-27: CVE Published. CVE-2017-9841 is published to NVD.
- 2022-02-15: CISA KEV. CVE-2017-9841 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-08-15: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2023-12-15: Rule Released. CrowdSec releases a rule to detect CVE-2017-9841 exploitation attempts against the CrowdSec Network.
- 2023-12-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2017-9841 for the first time.

## References

- https://security.gentoo.org/glsa/201711-15
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
- https://github.com/sebastianbergmann/phpunit/pull/1956
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9841.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2017-9841) follows observed exploitation activity for CVE-2017-9841. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.