1

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs:

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height%7c%7c1%3ba=e( HTTP/1.1" 403 222

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height||1;a=e( HTTP/1.1" 301 333

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /scripts/query-ui/js/]};F.optgroup=F.option;F.tbody=F.tfoot=F.colgroup=F.caption=F.thead;F.th
=F.td;if(!c.support.htmlSerialize)F._default=[1, HTTP/1.1" 404 338

Note that the requests different, and one of them responds with a 403, and the other a 301. There are actually a number of jQuery related scans from the same IP addresses. Almost always they respond with a 403.

The addresses all happen to be from countries that never use the website, and are definitely "unsolicited users".

I'm very frequently seeing this sort of entry. I couldn't find any reference to this attack in google.

My question really has two parts:

  • What is this attack attempting to do? Is there a compromise in jQuery, or websites setup to use jQuery?
  • Is there any particular worry? I'm guessing the answer here is "no", given that the requests are mostly 400 level, with the occasional 300 level. However, are there security measures I should look into to make sure that this sort of attack cannot succeed?

IP Addresses: They come from a variety of IPs. I've included a sample here. Because of the variety, I assumed they were compromised machines (i.e., a botnet) but I'm not sure.

133.50.201.25 (Japan, University domain)

89.29.175.68 (Trinidad and Tobago, root domain seems to be for a non-profit)

190.156.227.11 (Colombia, not sure what type of domain).

78.250.250.243 (France, no host info appears to be available)

I've seen others from Italy, Spain, etc

Improve this question
10
  • I guess these are just broken crawlers which use the wrong heuristic to extract and follow links.
    – Steffen Ullrich
    Commented Jan 10, 2016 at 21:46
  • Providing the IP addresses or ISPs may give us a better understanding of the nature of the requests
    – Ammar Bandukwala
    Commented Jan 10, 2016 at 21:54
  • @AmmarBandukwala I've added in a sampling of the IP addresses, with some notes
    – Sommel
    Commented Jan 11, 2016 at 0:02
  • @SteffenUllrich That makes sense. In other words, it's likely it isn't anything targeting a jQuery flaw, or the jQuery library itself.
    – Sommel
    Commented Jan 11, 2016 at 0:03
  • 1
    you use the term "vulnerability scan" - how does a vuln scan fit into the scenario?
    – schroeder ♦
    Commented Jan 11, 2016 at 20:33

1 Answer 1

Reset to default
1

Nothing to worry about.

This is regular internet noise, there are a lot of robots on the internet scanning the internet, even doing full IP traversals from 1.1.1.1 to 255.255.255.255 so even if your domain name is known only by you, someone will eventually scan your IP address.

Since the logs are calling javascript files there's nothing to worry about. Apache2 doesn't execute javascript code before rendering it, it just transmits the file as-is so there is no vulnerability to exploit through that vector.

The machines from where this comes can be anything, not necessarily from the same botnet, most unlikely so. They weren't interested in your site particularly, they just scan the entire internet and storing information, versions, etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .