Is CVE-2017-9841 exploited in the wild?

Yes. CVE-2017-9841 is known to be exploited in the wild, first recorded on 15 February 2022. Treat it as urgent.

How severe is CVE-2017-9841?

Critical severity, with a CVSS score of 3.1, published 26 March 2022.

Which products and versions are affected?

phpunit/phpunit (Packagist) ECOSYSTEM:introduced=4.8.19,fixed=4.8.28.

Is there a fix for CVE-2017-9841?

Yes. phpunit/phpunit (Packagist): upgrade to 4.8.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-9841 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-9841?

Check whether you run phpunit/phpunit (Packagist) or PHPUnit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-9841: Code Injection in PHPUnit

CVE-2017-9841 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2022-03-26

The eval-stdin.php component in PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data starting with a '<?php ' substring. This occurs when the /vendor folder is exposed to external access, enabling command injection.

Technologies: phpunit/phpunit (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2017-9841 exploited in the wild?: Yes. CVE-2017-9841 is known to be exploited in the wild, first recorded on 15 February 2022. Treat it as urgent.
How severe is CVE-2017-9841?: Critical severity, with a CVSS score of 3.1, published 26 March 2022.
Which products and versions are affected?: phpunit/phpunit (Packagist) ECOSYSTEM:introduced=4.8.19,fixed=4.8.28.
Is there a fix for CVE-2017-9841?: Yes. phpunit/phpunit (Packagist): upgrade to 4.8.28 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-9841 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-9841?: Check whether you run phpunit/phpunit (Packagist) or PHPUnit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpunit/phpunit (Packagist): upgrade to 4.8.28 or later
```
composer require phpunit/phpunit:^4.8.28
```

Affected products

PHPUnit Project PHPUnit before 4.8.28, 5.x before 5.6.3
Oracle Communications Diameter Signaling Router 8.0.0 - 8.5.0

Identifiers

CVE-2017-9841
GHSA-r7c9-c69m-rph8

Timeline

2017-06-24: disclosed: Initial CVE assignment date (implied by CVE ID)
2017-11-14: advisory: SecurityFocus BID 101798 published
2021-10-20: patched: Oracle released patches in Critical Patch Update
2022-02-15: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2022-02-15: exploited: Confirmed exploited in the wild per CISA KEV catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.