1

Recently I've been seeing a major uptick in the following type of requests to my Apache logs:

"GET /CHANGELOG.txt HTTP/1.1" 404 211

About a month ago, I received none. Now I receive a dozen or so each day. Occasionally they are accompanied by other more obvious vulnerability scans, but usually they come by themselves.

They are all coming from IP addresses that would be very unusual for users of our server.

I'm not particularly worried about a direct security threat, because they are 404.

However my question is:

  • Is this actually a vulnerability scan? If so, which one?
  • If it isn't, does anyone know what it is? Have others been having these recently too?
2

Is this actually a vulnerability scan? If so, which one?

I would assume so (it's difficult to say for sure, but it makes sense).

It's also a rather practical file to scan for. With one request, an attacker can check if you have installed one of multiple applications.

Additionally, a changelog will also contain a current version number, so there is no need to additionally scan for that.

One prominent application having such a file would be Drupal, but it's a very generic file name, so many other applications will use it as well.

An attacker could also apply basic filters on the first couple of lines of the file and get a string likely containing the application name. They can then manually look it over and store it in a database or check if whatever is running is vulnerable.

  • Interesting. I see the value (for them) in scanning for the change log of Drupal. The change log itself would also likely contain the version number (as the previous responder stated). I just looked into the history of my logs going much further back. CHANGELOG.txt requests happened very sporadically in 2015, always in conjunction with other vulnerability scanning. Suddenly starting a few days ago, it happens every day, from various disparate IPs, usually by themselves. I suppose there might be a new scanning script out. – SCruz Mar 22 '16 at 18:04
2

Probably someone figured out you are using a out of box solution(say a CMS) like Joomla,Wordpress,Drupal.

That CHANGELOG.txt is a file in Drupal CMS. I am not sure if that is the one on your server.

So, the attacker may be trying to know which version of CMS(Drupal) is it. So that he can use any exploits known to effect that particular version.

  • I don't actually have Drupal, or any out of the box software CMS (or similar) software on the server, and I don't have any files with that name. Perhaps they are random scans trying to determine if I, or others, are using Drupal. – SCruz Mar 22 '16 at 17:55
  • yup. These are from bots trying to determine the version of commonly used software so they can know if it's even worth messing around with your server. – Grimmy Mar 28 '16 at 2:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.