CVE-2017-9841

What it actually does

The vulnerability permits unauthenticated remote attackers to execute arbitrary PHP code by sending HTTP POST requests containing PHP payloads starting with '<?php ' directly to the eval-stdin.php script, which is exposed when the /vendor directory is publicly accessible.

Why it matters to the business

Attackers can fully compromise affected web applications and servers, leading to data breaches, service disruption, and potential ransomware or persistent access; the issue remains actively exploited years after disclosure with a past CISA remediation deadline, amplifying risk for any organizations still running unpatched PHPUnit instances.

How an attack unfolds

An attacker first discovers an exposed /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php endpoint on a target site, then crafts and sends a POST request whose body begins with '<?php ' followed by malicious code; the script evaluates and executes the payload server-side, granting the attacker remote code execution without authentication or user interaction.

How to fix it

Upgrade to PHPUnit 4.8.28 or 5.6.3 or later; for listed products apply the exact fixed versions aws-load-balancer-controller-fips (Chainguard) 2.7.2-r4 or sebastianbergmann/phpunit (GIT) 284a69fb88a2d0845d23f42974a583d8f59bf5a5; restrict public access to /vendor directories and remove or block eval-stdin.php if not required.

How to confirm the fix worked

Verify that eval-stdin.php no longer exists or returns errors on POST, confirm package versions match the listed fixed releases, and test that requests to the former URI are blocked or return 404/403.

Typical attack path

1. Scan for publicly accessible /vendor/phpunit paths or eval-stdin.php endpoints
2. Send crafted HTTP POST containing '<?php ' followed by arbitrary code
3. Achieve remote code execution to deploy webshells, exfiltrate data, or pivot internally

How to detect it

Search web server access logs for POST requests to paths containing eval-stdin.php or /vendor/phpunit, especially those with bodies beginning with '<?php '; review application and system logs for unexpected process spawns or file writes following such requests.

• POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
• HTTP body starting with '<?php '
• Access to eval-stdin.php URI

What your security team should do

• Immediately inventory all instances of PHPUnit and block or upgrade any version prior to the fixed releases
• Enforce network controls preventing external access to /vendor directories
• Monitor for KEV-listed exploitation and prioritize patching due to active in-the-wild use