I opened my apache error logs today and found this:
[Fri Apr 28 06:52:59.219655 2017] [cgi:error] [pid 25030] [client 172.30.0.155:12810] script not found or unable to stat: /var/www/cgi-bin/webcm
I have never put anything in the cgi-bin folder, but it was made accessible in the apache config, because that was the default setting:
<Directory "/var/www"> AllowOverride None # Allow open access: Require all granted </Directory> <Directory "/var/www/cgi-bin"> AllowOverride None Options None Require all granted </Directory>
However, none of the virtualhosts that I had set up were configured to point anywhere outside of /var/www/html. How did someone query this folder if nothing pointed to it? Also, is there any significance to the ip address that it came from?
I have since chmoded cgi-bin to 700 and restricted access to it in the apache config. Are there any other steps I need to take?