Attackers are leveraging a vulnerability patched nearly three years ago to target Drupal sites. Background On September 4, Drupal published PSA-2019-09-04, a public service announcement (PSA) for a vulnerability in a third-party library in a Drupal module that’s being actively exploited in the wild.

CVE-2017-9841: Drupal Sites Exploited Using PHPUnit Vulnerability in Mailchimp Modules (PSA-2019-0904)

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

PHPUnit is a testing framework for PHP built to perform unit tests in the application development cycle. PHPUnit versions before 4.8.28 and 5.x before 5.6.3 allow remote attackers to execute arbitrary PHP code via the /vendor/phpunit/src/Util/PHP/eval-stdin.php URI when exposed.

The instance of Drupal running on the remote host is affected by a command execution vulnerability. A remote, unauthenticated attacker can exploit this issue, via a specially crafted HTTP request, to execute commands on the remote host.

The remote host is affected by the vulnerability described in GLSA-201711-15 (PHPUnit: Remote code execution)

    When PHPUnit is installed in a production environment via composer and       these modules are in a web accessible directory, the eval-stdin.php file       in PHPUnit contains vulnerable statements that trigger the vulnerability.
  Impact :

    A remote attacker could possibly execute arbitrary PHP code or cause a       Denial of Service condition.
  Workaround :

    There are several ways to fix or mitigate this vulnerability:
    Remove PHPUnit from the production environment.
    Update PHPUnit.
    Manually apply the patch.
    Disable direct access to the composer packages by placing .htaccess file       to /vendor folder.

mediawiki reports :

security fixes :

T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.

T165846: BotPasswords doesn't throttle login attempts.

T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.

T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.

T176247: It's possible to mangle HTML via raw message parameter expansion.

T125163: id attribute on headlines allow raw.

T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.

T119158: Language converter: unsafe attribute injection via glossary rules.

T180488: api.log contains passwords in plaintext wasn't correctly fixed.

T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.

ID	Name	Product	Family	Severity
98984	PHPUnit Remote Code Execution	Web App Scanning	Component Vulnerability	critical
98704	Drupal PHPUnit/Mailchimp Code Execution Vulnerability	Web App Scanning	Component Vulnerability	critical
128551	Drupal PHPUnit/Mailchimp Code Execution Vulnerability	Nessus	CGI abuses	critical
104696	GLSA-201711-15 : PHPUnit: Remote code execution	Nessus	Gentoo Local Security Checks	critical
104693	FreeBSD : mediawiki -- multiple vulnerabilities (298829e2-ccce-11e7-92e4-000c29649f92)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-9841

critical

Tenable Plugins

critical

critical

critical

critical

critical