1

I opened my apache error logs today and found this:

[Fri Apr 28 06:52:59.219655 2017] [cgi:error] [pid 25030] [client 172.30.0.155:12810] script not found or unable to stat: /var/www/cgi-bin/webcm

I have never put anything in the cgi-bin folder, but it was made accessible in the apache config, because that was the default setting:

<Directory "/var/www">
    AllowOverride None
    # Allow open access:
    Require all granted
</Directory>

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

However, none of the virtualhosts that I had set up were configured to point anywhere outside of /var/www/html. How did someone query this folder if nothing pointed to it? Also, is there any significance to the ip address that it came from?

I have since chmoded cgi-bin to 700 and restricted access to it in the apache config. Are there any other steps I need to take?

  • it's a default directory and scanners will try to see if there is anything there – schroeder Apr 28 '17 at 13:55
  • Yes, thank you. But how did they even manage to query for this folder? Since no virtualhost points to it, the request to example.com/cgi-bin/webcm should have resulted in a 404 response from Django, with nothing reported to the apache error logs, as it does when I test it. This should have been handled at that level, not at the apache level. Do you have any idea why it would show up here instead? – kloddant Apr 28 '17 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.