CVE-2020-13756

CRITICAL

Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-13756 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 12, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Lab environments
1

Affected products and versions

2
ProductSourceVersion range

php_css_parser

Browse sabberworm / php_css_parser
VulnCheckVersion data not supplied

sabberworm/php-css-parser

Browse Packagist / sabberworm/php-css-parser
GitHub Advisory8.3.0 to < 8.3.1 · Fixed in 8.3.1affected
8.2.0 to < 8.2.1 · Fixed in 8.2.1affected
3.0.0 to < 3.0.1 · Fixed in 3.0.1affected
2.0.0 to < 2.0.1 · Fixed in 2.0.1affected
1.0.0 to < 1.0.1 · Fixed in 1.0.1affected
8.1.0 to < 8.1.1 · Fixed in 8.1.1affected
8.0.0 to < 8.0.1 · Fixed in 8.0.1affected
7.0.0 to < 7.0.4 · Fixed in 7.0.4affected
6.0.0 to < 6.0.2 · Fixed in 6.0.2affected
5.2.0 to < 5.2.1 · Fixed in 5.2.1affected
5.1.0 to < 5.1.3 · Fixed in 5.1.3affected
5.0.0 to < 5.0.9 · Fixed in 5.0.9affected
Showing 12 of 13 version ranges

Proofs of concept

1

Repository PoCs

GitHubKrE80r/CVE-2020-13756-envRepository PoCby KrE80r0Scanner4 files

3.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact sets up a vulnerable Docker environment for CVE-2020-13756 and provides a curl command to verify the vulnerability by checking for a specific output string, which is scanner behavior.

Backdoor review

No backdoor observed in reviewed code

The repository provides a deliberately vulnerable Docker environment for CVE-2020-13756. The index.php file directly passes a user-supplied GET parameter to the known-vulnerable getSelectorsBySpecificity() function, which is the documented CVE behavior. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm is present in the reviewed text files.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPHPDockerfile
Target softwareSabberworm PHP CSS Parser
Attack typescode injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a vulnerable test environment and verification instructions. The index.php script is a deliberately vulnerable test harness, not an exploit. The README provides a curl command that tests for the vulnerability by checking for a specific output string ('VULN_TEST'), which is scanner behavior (detection/validation) rather than exploitation. No standalone exploit code is present.

README.md:1-3README.md:39-46index.php:1-20

Requirements

  • Docker must be installed and running to build and run the container.README.md:18
  • The target application must be accessible via HTTP on the specified port.README.md:43

Observed behavior

  • Builds a Docker image with a vulnerable version of Sabberworm PHP CSS Parser (8.3.0) and a test script that passes user input to the vulnerable getSelectorsBySpecificity function.Dockerfile:12-13index.php:14
  • Provides a curl command that sends a payload to the test script and checks if the response contains 'VULN_TEST', indicating successful code execution.README.md:42-44
  • Includes a Nuclei template reference for automated vulnerability scanning.README.md:50-52
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerable Code
Payload withheldThis is the exact vulnerable pattern described in CVE-2020-13756, where unsanitized user input reaches eval(). It is the intended PoC behavior, not a backdoor.index.php:14
Vulnerable Dependency
Payload withheldThe Dockerfile installs the vulnerable version of the library, consistent with the stated CVE scope.Dockerfile:12-13
Review boundaries

What the analysis did not establish

  • One file (docker-compose.yml) is omitted from the text evidence; its content is unknown.
  • The Nuclei template file (CVE-2020-13756.yaml) is referenced but not included in the evidence.
  • One file (docker-compose.yml, 79 bytes) was not included as text content; only its metadata was provided. Its omission is noted but does not indicate backdoor behavior given the complete coverage of the core application files.
  • Binary files were not inspected; the binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, and no binary files were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

KrE80r/CVE-2020-13756-envCreated Vuln labCVE-2020-13756Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a PHP 8.0 Apache container serving a vulnerable Sabberworm PHP CSS Parser application, intended for demonstrating CVE-2020-13756 remote code execution.

docker-compose.yml:1-6Dockerfile:1-21index.php:1-20README.md:1-77

Lab assessment

Vulnerability lab

The README explicitly states it is a 'Vulnerable test environment for CVE-2020-13756', the Dockerfile installs a vulnerable version of the library, and index.php contains a deliberate vulnerable code path that passes user input to eval().

README.md:1-3Dockerfile:11-12index.php:8-13
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable

web servervulnerable application

A service built from the local Dockerfile, exposing port 80 on the container mapped to host port 8080. It runs Apache with PHP 8.0 and serves index.php, which uses the Sabberworm PHP CSS Parser library version 8.3.0 and contains a deliberate eval() vulnerability.

docker-compose.yml:3-6Dockerfile:1-21index.php:1-20
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-13756

Supported by supplied evidence

The README describes the vulnerability as remote code execution in Sabberworm PHP CSS Parser < 8.3.1 via eval() in getSelectorsBySpecificity(). The Dockerfile installs version 8.3.0, and index.php demonstrates passing unsanitized user input to that function, matching the CVE description.

README.md:1-3README.md:7-13Dockerfile:11-12index.php:8-13
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host to build and run the environment.README.md:17-19
  • Network access to port 8080 on the host to trigger the vulnerability via HTTP request.docker-compose.yml:5README.md:37-38

Evidence-described exercise path

  1. Build and start the vulnerable container using docker-compose up -d or the provided one-liner.README.md:17-19
  2. Send an HTTP request to the container with a crafted 'n' parameter that injects PHP code into the eval() call, e.g., curl 'http://localhost:8080/?n=100;printf(%22VULN_TEST%22);'.README.md:37-38index.php:8-13
  3. Observe the response containing the output of the injected code (e.g., 'VULN_TEST'), confirming remote code execution.README.md:40
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own container: the Dockerfile installs a known vulnerable library and serves a deliberate exploit demonstration. The port mapping (8080:80) is a standard lab requirement for accessing the web service. No evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability exercise.

docker-compose.yml:1-6Dockerfile:1-21index.php:1-20README.md:1-77
Review boundaries

What the analysis did not establish

  • The packet does not include the composer.lock or vendor directory, so the exact installed library files are not inspected; the version is inferred from the composer.json requirement.
  • The Dockerfile uses a COPY --from=composer:latest instruction, which pulls an external image at build time; the behavior of that image is not inspected, but it is a standard Composer image.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

8