# PHPUnit is included in groupfolders release package potentially causing RCE

Nextcloud groupfolders release tarball ships PHPUnit's eval-stdin.php, which evaluates php://stdin, enabling unauthenticated RCE when reachable via FastCGI.

- Payout: hidden
- Severity: high
- Program: Nextcloud
- Found by: ledfan
- Disclosed: 2020-06-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/820146
- Library page: https://bugbountylibrary.com/r/h1%3A820146
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:rce

**Target:** PHPUnit eval-stdin.php in vendor dir of groupfolders app
**Root cause:** Release tarball bundles PHPUnit dev dependency including eval-stdin.php, which runs eval(file_get_contents('php://stdin')); under CGI/FastCGI php://stdin exposes the HTTP request body.
**Steps:**
1. Download groupfolders v6.0.2 tarball and note vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
2. Configure Nextcloud so URLs retain index.php (no rewrite) so the file is web-reachable
3. POST PHP code to the eval-stdin.php path; body is read via php://stdin and eval'd
**How found:** Noticed PHPUnit bundled in the release tarball's vendor dir, recalled thephp.cc advisory on eval-stdin.php, then tested whether the file was web-accessible when index.php is not rewritten.
**Exploitation:** Attacker POSTs arbitrary PHP to the reachable eval-stdin.php endpoint; under FastCGI the request body is available on php://stdin and eval'd, yielding RCE. Author could not reproduce under their FastCGI configs but confirmed file reachability unauthenticated.
**Insight:** Check shipped release tarballs (not just git) for dev dependencies like PHPUnit; eval-stdin.php is only reachable when URL rewriting is off, so test both rewrite configurations.