1

Recently I've been seeing a major uptick in the following type of requests to my Apache logs:

"GET /CHANGELOG.txt HTTP/1.1" 404 211

About a month ago, I received none. Now I receive a dozen or so each day. Occasionally they are accompanied by other more obvious vulnerability scans, but usually they come by themselves.

They are all coming from IP addresses that would be very unusual for users of our server.

I'm not particularly worried about a direct security threat, because they are 404.

However my question is:

  • Is this actually a vulnerability scan? If so, which one?
  • If it isn't, does anyone know what it is? Have others been having these recently too?
Improve this question

2 Answers 2

Reset to default
2

Is this actually a vulnerability scan? If so, which one?

I would assume so (it's difficult to say for sure, but it makes sense).

It's also a rather practical file to scan for. With one request, an attacker can check if you have installed one of multiple applications.

Additionally, a changelog will also contain a current version number, so there is no need to additionally scan for that.

One prominent application having such a file would be Drupal, but it's a very generic file name, so many other applications will use it as well.

An attacker could also apply basic filters on the first couple of lines of the file and get a string likely containing the application name. They can then manually look it over and store it in a database or check if whatever is running is vulnerable.

Improve this answer
1
  • Interesting. I see the value (for them) in scanning for the change log of Drupal. The change log itself would also likely contain the version number (as the previous responder stated). I just looked into the history of my logs going much further back. CHANGELOG.txt requests happened very sporadically in 2015, always in conjunction with other vulnerability scanning. Suddenly starting a few days ago, it happens every day, from various disparate IPs, usually by themselves. I suppose there might be a new scanning script out.
    – Sommel
    Commented Mar 22, 2016 at 18:04
2

Probably someone figured out you are using a out of box solution(say a CMS) like Joomla,Wordpress,Drupal.

That CHANGELOG.txt is a file in Drupal CMS. I am not sure if that is the one on your server.

So, the attacker may be trying to know which version of CMS(Drupal) is it. So that he can use any exploits known to effect that particular version.

Improve this answer
2
  • I don't actually have Drupal, or any out of the box software CMS (or similar) software on the server, and I don't have any files with that name. Perhaps they are random scans trying to determine if I, or others, are using Drupal.
    – Sommel
    Commented Mar 22, 2016 at 17:55
  • yup. These are from bots trying to determine the version of commonly used software so they can know if it's even worth messing around with your server.
    – Grimmy
    Commented Mar 28, 2016 at 2:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .