Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The problem is as follows:

  1. In the local host machine (let's call it 'A'), there is a apache server hosting some web application.
  2. A user use the local host machine to access a web application site hosted on a remote host machine (let's call it 'B').
  3. The user notice that the apache log file keep on having the following message as follows when he access the web application site hosted on 'B':
    127.0.0.1 - - [28/May/2013:08:49:20 +0100] "PROPFIND /test2/desktop.ini HTTP/1.1" 405 1810 "-" "Microsoft-WebDAV-MiniRedir/6.1.7601"
    127.0.0.1 - - [28/May/2013:08:49:20 +0100] "PROPFIND /test2/desktop.ini HTTP/1.1" 405 1810 "-" "Microsoft-WebDAV-MiniRedir/6.1.7601"
    127.0.0.1 - - [28/May/2013:08:49:20 +0100] "PROPFIND /test2/desktop.ini HTTP/1.1" 405 1810 "-" "Microsoft-WebDAV-MiniRedir/6.1.7601"
    127.0.0.1 - - [28/May/2013:08:49:20 +0100] "PROPFIND /test2/desktop.ini HTTP/1.1" 405 1810 "-" "Microsoft-WebDAV-MiniRedir/6.1.7601"

Every time the user use the web browser to access the 'B' web application from the local host machine 'A', the local host machine 'A' apache log files will keep on pouring the above messages.

So, is this 'A' server security issue or is this 'B' server security issue?

share|improve this question
    
Seems like server A –  Maximin Oct 29 '13 at 10:52

1 Answer 1

127.0.0.1 is "localhost" and can be contacted only from the machine itself. So the connections you see in the logs must come from something on the machine 'A' itself.

PROPFIND is part of WebDAV, which can be viewed as an extension on HTTP to turn it into a file server. "Microsoft-WebDAV-MiniRedir" is a Windows component which allows folders exported with WebDAV to be accessible as UNC shares; in other words, if there is a Web server on localhost, which serves files through WebDAV, and some application wants to access these files with a path like "\\localhost\test2\desktop.ini", then the Web server will receive connections like the ones you see in your logs.

So my guess is that there is something related to the browser which tries to read a file called "\\localhost\test2\desktop.ini"; the WebDAV mini-redirector then tries to convert that into a HTTP PROPFIND request to the Web server on localhost. That Web server happens not to do WebDAV at all, resulting in an error response (405) and a log entry.

The good question, now, is: what is trying to read "\\localhost\test2\desktop.ini" ? A possible scenario is the following: the Web page served by machine 'B' contains a link, e.g. something like this:

<img src="\\localhost\test2\desktop.ini" />

and such a link could be the result of a configuration error on 'B', or maybe, possibly, some sort of automated attack attempt (the site on 'B' trying to gain some access to files on 'A'). I find the latter relatively implausible (it would be a relatively clumsy attempt) and, in any case, it did not work (your Apache server does not talk WebDAV). To make sure, search for such a link in the Web page source as served by 'B'.

Other scenarios to investigate include a proxy configuration on the browser, or some "security tool" which tries to scan files in search of virus, and may do so on remote files through WebDAV. In the jungle of Microsoft products, stranger things have appeared. Some Googling shows that other people have found such log entries, e.g. there and there.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.