CVE-2017-9841

Laravel-RCE: CVE-2017-9841

CVE-2017-9841 is a critical remote code execution (RCE) vulnerability that affects the PHPUnit library, widely used for automated testing in PHP. This flaw allows an attacker to execute arbitrary commands on the server if they can access a specific PHPUnit file that is publicly exposed.

📌 Key Details

• Identifier: CVE-2017-9841
• GOOGLE DORK: "inurl:"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"
• Affected Product: PHPUnit (component phpunit/phpunit)
• Vulnerable Versions: prior to 5.6.3 and 4.8.28
• Vulnerability Type: Remote Code Execution (RCE)
• Impact: Critical – allows an attacker to execute arbitrary PHP code on the server.

🔍 How the vulnerability works The problem lies in the eval-stdin.php file, located at:

/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

(or in similar paths depending on the project structure).

This file was designed for internal use by PHPUnit, but in many installations it remains publicly accessible. The code of this file simply reads data from standard input (php://input) and directly executes it with the eval() function. In other words, any POST request sent to this endpoint will be evaluated as PHP code.

Exploitation example
An attacker can send an HTTP POST request to the vulnerable file containing, for example:

POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

Payload 🛡️ " <?php phpinfo(); ?> " 

The server will execute the code and return the output, confirming execution.

With this, the attacker can escalate the attack to obtain a reverse shell, read sensitive files, modify data, etc.

🛡️ Mitigation

• Update PHPUnit to a patched version (≥ 5.6.3 or ≥ 4.8.28).
• Remove or restrict access to the vendor/phpunit/ directory in production environments, since test libraries should not be publicly accessible.
• Configure the server to block requests to common test files, such as eval-stdin.php.
• Use a Web Application Firewall (WAF) to detect and block exploitation attempts.

📚 Additional context This vulnerability became very well known because many projects inadvertently leave the vendor directory publicly accessible. Since PHPUnit is a common dependency in PHP projects (including frameworks like Laravel, Symfony, etc.), accidental exposure is frequent. Therefore, it is one of the first vectors tested in automated security scans.

If you are a developer or system administrator, check that your production sites do not have the eval-stdin.php file accessible externally.