Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am being attacked with this cgi injection:

POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1

This decodes as

//cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -d auto_prepend_file=php://input -n

Php version is 5.2.6-1+lenny13, yes thats old.

How can I prevent this attack?

share|improve this question
2  
Update your PHP to the latest version. You are missing out a lot. –  Ebenezar Dec 6 '13 at 10:44
    
@Ebenezar apt-get upgrade php has nothing to do. System upgrade is not possible at the moment. –  PiTheNumber Dec 6 '13 at 10:45
    
Upgrade to at least Squeeze. Lenny is EOL and has been for a while. –  Shadur Dec 6 '13 at 12:47
    
@Shadur Yes, sure this will be done at the next possible date. I needed a quick fix until then. –  PiTheNumber Dec 6 '13 at 14:16
2  
This is not the only critical vulnerability that affects your system. You need to upgrade, that is the only option. –  Rook Dec 6 '13 at 16:20
add comment

2 Answers

up vote 9 down vote accepted

A system upgrade is required but here a quick fix.

In /etc/apache2/sites-enabled/000-default I comment out:

   ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
   <Directory "/usr/lib/cgi-bin">
           AllowOverride None
           Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
           Order allow,deny
           Allow from all
   </Directory>

And did a apache2ctl restart. Now /cgi-bin/php is not accessible anymore. That should fix it.

Wonder why this is in default anyway. You should also check other pages in sites-enabled. Do a grep "ExecCGI" /etc/apache2/sites-enabled.

share|improve this answer
    
It works very well! –  P. R. Ribeiro Dec 8 '13 at 23:37
add comment

Besides the obvious update everything advice, the simplest solution is don't put your php interpreter in your cgi-bin directory. In fact, don't put any interpreter in your cgi-bin directory; not php, not perl, not bash, not sed, not awk, not vi, nor any program that executes arbitrary commands passed to it.

If your hosting configuration requires that your interpreter be put in cgi-bin, then change your hosting configuration. There are plenty of reasonable alternatives that don't resort to this silly idea.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.