Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am being attacked with this cgi injection:

POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1

This decodes as

//cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -d auto_prepend_file=php://input -n

Php version is 5.2.6-1+lenny13, yes thats old.

How can I prevent this attack?

share|improve this question
Update your PHP to the latest version. You are missing out a lot. – Ebenezar Dec 6 '13 at 10:44
@Ebenezar apt-get upgrade php has nothing to do. System upgrade is not possible at the moment. – PiTheNumber Dec 6 '13 at 10:45
Upgrade to at least Squeeze. Lenny is EOL and has been for a while. – Shadur Dec 6 '13 at 12:47
@Shadur Yes, sure this will be done at the next possible date. I needed a quick fix until then. – PiTheNumber Dec 6 '13 at 14:16
This is not the only critical vulnerability that affects your system. You need to upgrade, that is the only option. – rook Dec 6 '13 at 16:20
up vote 11 down vote accepted

A system upgrade is required but here a quick fix.

In /etc/apache2/sites-enabled/000-default I comment out:

   ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
   <Directory "/usr/lib/cgi-bin">
           AllowOverride None
           Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
           Order allow,deny
           Allow from all

And did a apache2ctl restart. Now /cgi-bin/php is not accessible anymore. That should fix it.

Wonder why this is in default anyway. You should also check other pages in sites-enabled. Do a grep "ExecCGI" /etc/apache2/sites-enabled.

share|improve this answer
It works very well! – P. R. Ribeiro Dec 8 '13 at 23:37

Besides the obvious update everything advice, the simplest solution is don't put your php interpreter in your cgi-bin directory. In fact, don't put any interpreter in your cgi-bin directory; not php, not perl, not bash, not sed, not awk, not vi, nor any program that executes arbitrary commands passed to it.

If your hosting configuration requires that your interpreter be put in cgi-bin, then change your hosting configuration. There are plenty of reasonable alternatives that don't resort to this silly idea.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.