PHPUnit is a testing framework. To run tests in isolated processes, PHPUnit sometimes needs to spin up a separate PHP process, send it some code, and capture the output. The eval-stdin.php file was written to facilitate this.
Original code (simplified):
# /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
eval('?>' . file_get_contents('php://stdin'));
In a legitimate development environment (CLI), a developer might pipe PHP code into this script: index of vendor phpunit phpunit src util php evalstdinphp
echo "<?php echo 2+2;" | php eval-stdin.php
The script reads from STDIN, evaluates the string as PHP code, and outputs the result.
The attack targets websites that have the vendor directory publicly accessible. This often occurs due to misconfigured web servers (Apache/Nginx) where the web root points to the project root, or where .htaccess rules do not restrict access to internal directories. PHPUnit is a testing framework
In affected versions, the content of EvalStdin.php is roughly as follows:
<?php
// vendor/phpunit/phpunit/src/Util/PHP/EvalStdin.php
// ... potential namespace definitions ...
// The script reads from standard input
$code = file_get_contents('php://input');
// It immediately evaluates the code without validation
eval($code);
PHPUnit is a unit testing framework for PHP. It is widely used in the PHP development community to ensure that code behaves as expected. The framework includes various utilities and functionalities to facilitate comprehensive testing. One such utility file is eval-stdin.php located within the src/Util/PHP directory of PHPUnit. In a legitimate development environment (CLI), a developer
The purpose of eval-stdin.php is to evaluate PHP code provided through standard input. This functionality can be useful for executing PHP code snippets dynamically, which might be necessary in certain testing scenarios or when integrating PHPUnit with other tools.
Exploiting this vulnerability is trivial and requires no authentication or sophisticated exploit chains.
If you encounter a live, publicly accessible directory index at any point along this path (e.g., /vendor/, /vendor/phpunit/, /vendor/phpunit/phpunit/, etc.), it indicates multiple severe misconfigurations: