Attackers are leveraging a vulnerability patched nearly three years ago to target Drupal sites. Background On September 4, Drupal published PSA-2019-09-04, a public service announcement (PSA) for a vulnerability in a third-party library in a Drupal module that’s being actively exploited in the wild.

CVE-2017-9841: Drupal Sites Exploited Using PHPUnit Vulnerability in Mailchimp Modules (PSA-2019-0904)

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Recent reporting suggests that attackers are exploiting this eight-year-old vulnerability to deploy Kinsing and XMRig malware.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute
    arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on
    a site with an exposed /vendor folder, i.e., external access to the
    /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI. (CVE-2017-9841)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7171-1 advisory.

    It was discovered that PHPUnit incorrectly handled web requests if exposed to the internet. An attacker     could possibly use this issue to achive remote code execution or obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

PHPUnit is a testing framework for PHP built to perform unit tests in the application development cycle. PHPUnit versions before 4.8.28 and 5.x before 5.6.3 allow remote attackers to execute arbitrary PHP code via the /vendor/phpunit/src/Util/PHP/eval-stdin.php URI when exposed.

The instance of Drupal running on the remote host is affected by a command execution vulnerability. A remote, unauthenticated attacker can exploit this issue, via a specially crafted HTTP request, to execute commands on the remote host.

The remote host is affected by the vulnerability described in GLSA-201711-15 (PHPUnit: Remote code execution)

    When PHPUnit is installed in a production environment via composer and       these modules are in a web accessible directory, the eval-stdin.php file       in PHPUnit contains vulnerable statements that trigger the vulnerability.
  Impact :

    A remote attacker could possibly execute arbitrary PHP code or cause a       Denial of Service condition.
  Workaround :

    There are several ways to fix or mitigate this vulnerability:
    Remove PHPUnit from the production environment.
    Update PHPUnit.
    Manually apply the patch.
    Disable direct access to the composer packages by placing .htaccess file       to /vendor folder.

mediawiki reports :

security fixes :

T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.

T165846: BotPasswords doesn't throttle login attempts.

T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.

T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.

T176247: It's possible to mangle HTML via raw message parameter expansion.

T125163: id attribute on headlines allow raw.

T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.

T119158: Language converter: unsafe attribute injection via glossary rules.

T180488: api.log contains passwords in plaintext wasn't correctly fixed.

T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.

ID	Name	Product	Family	Type	Severity
418561	SCA: security update for phpunit/phpunit (GHSA-r7c9-c69m-rph8)	Tenable Cloud Security	SCA Checks	Local	critical
418561	SCA: security update for phpunit/phpunit (GHSA-r7c9-c69m-rph8)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
213190	Ubuntu 16.04 LTS : PHPUnit vulnerability (USN-7171-1)	Nessus	Ubuntu Local Security Checks	Local	critical
98984	PHPUnit Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
98704	Drupal PHPUnit/Mailchimp Code Execution Vulnerability	Web App Scanning	Component Vulnerability	Check Based	critical
128551	Drupal PHPUnit/Mailchimp Code Execution Vulnerability	Nessus	CGI abuses	Remote	critical
104696	GLSA-201711-15 : PHPUnit: Remote code execution	Nessus	Gentoo Local Security Checks	Local	critical
104693	FreeBSD : mediawiki -- multiple vulnerabilities (298829e2-ccce-11e7-92e4-000c29649f92)	Nessus	FreeBSD Local Security Checks	Local	critical

Detections

Analytics

CVE-2017-9841

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical