Command Injection in PHPUnit (CVE‑2017‑9841) Enables Remote Code Execution
What It Is – PHPUnit 5.0‑5.6 contains a command‑injection flaw in eval‑stdin.php. An attacker can send a POST request whose body starts with <?php and achieve arbitrary PHP code execution on any server that exposes the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php endpoint.
Exploitability – Public PoC exists; exploitation requires only network access to the vulnerable path. The CVSS v3.1 base score is 7.5 (High).
Affected Products – PHPUnit library (versions 5.0 through 5.6) when deployed in a web‑accessible /vendor directory.
Why It Matters for Trust & Control Assurance
- Application security controls – The flaw highlights the risk of shipping development‑only packages to production, violating the control objective of maintaining a hardened, minimal attack surface.
- Continuous configuration monitoring – Detecting unexpected
/vendorexposure and unauthorized file paths is essential evidence for audit readiness across frameworks (e.g., NIST CSF, ISO 27001). - Defensible evidence – Demonstrating that your CI/CD pipeline enforces removal of test libraries from production builds provides a tangible control artifact for regulators and enterprise buyers.
Recommended Actions
- Remove PHPUnit from production – Ensure the
vendordirectory on live servers does not contain testing frameworks. - Implement path‑access controls – Block public HTTP access to any
/vendor/*paths via web‑server rules or WAF policies. - Scan for remnants – Run an automated inventory of installed Composer packages on production hosts and remediate any that are not required.
- Document the remediation – Capture configuration snapshots and remediation tickets as evidence for control assurance audits.
Source: CISA KEV – CVE‑2017‑9841