Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs:
access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height%7c%7c1%3ba=e( HTTP/1.1" 403 222 access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height||1;a=e( HTTP/1.1" 301 333 access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /scripts/query-ui/js/]};F.optgroup=F.option;F.tbody=F.tfoot=F.colgroup=F.caption=F.thead;F.th =F.td;if(!c.support.htmlSerialize)F._default=[1, HTTP/1.1" 404 338
Note that the requests different, and one of them responds with a 403, and the other a 301. There are actually a number of jQuery related scans from the same IP addresses. Almost always they respond with a 403.
The addresses all happen to be from countries that never use the website, and are definitely "unsolicited users".
I'm very frequently seeing this sort of entry. I couldn't find any reference to this attack in google.
My question really has two parts:
- What is this attack attempting to do? Is there a compromise in jQuery, or websites setup to use jQuery?
- Is there any particular worry? I'm guessing the answer here is "no", given that the requests are mostly 400 level, with the occasional 300 level. However, are there security measures I should look into to make sure that this sort of attack cannot succeed?
IP Addresses: They come from a variety of IPs. I've included a sample here. Because of the variety, I assumed they were compromised machines (i.e., a botnet) but I'm not sure.
22.214.171.124 (Japan, University domain)
126.96.36.199 (Trinidad and Tobago, root domain seems to be for a non-profit)
188.8.131.52 (Colombia, not sure what type of domain).
184.108.40.206 (France, no host info appears to be available)
I've seen others from Italy, Spain, etc