What is the best way to prevent code injection in Apache/PHP?

Question

I have recently setup wordpress on a VPS, and it is under continuous attack since. I have taken some measures to protect from some bruteforce attacks, however looking at some of the logs I am not sure if that's enough.

Below is one of the many rough requests I see in my Apache log-

12x.24x.3x.45 - - [30/Oct/2017:20:34:24 +0000] "GET http://4x.9x.23x.250:58204/jsip.php?zl=IP&IP=3x.18x.24x.19x&DK=80&DD=RZLWHADALAHBNPRL HTTP/1.0" 301 395 "-" "Mozilla/5.0  (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.92 Safari/537.1 LBBROWSER"

As far as I could understand, attacker is trying to inject and execute PHP code from remote site, and server responded with 301 (permanently moved) and response contained 395 bytes.

How can I protect server from processing such requests?

• .htaccess rule to deny values like that?
• Apache mod rewrite to reject such request?
• Sanitize from application load balancer?
• Is Apache/PHP/Wordpress vulnerable to such requests?

Shouldn't they already have this protection, and I can depend on them and relax? If not, I don't understand how so many Wordpress sites are still up, assuming that many of them probably did not have security experts working for the site.

Answer 1

... "GET http://4x.9x.23x.250:58204/jsip.php?zl=IP&IP=3x.18x.24x.19x&DK=80&DD=RZLWHADALAHBNPRL HTTP/1.0" 301 395 ...

As far as I could understand, attacker is trying to inject and execute php code from remote site, ...

I don't see any injection attempt here. This looks more like somebody is trying to use your server as a proxy to reach http://4x.9x.23x.250:58204/.... It might be somebody scanning the internet to find open proxies. As long as your system is not configured to be an open proxy there is no need to worry about this, i.e. treat this request as the usual noise you get when having a system accessible from the internet.

Answer 2

I don't know if "relax" is the right answer, but I would say that there is no obvious signs of a problem. Consider this your introduction to the number one rule of the internet: if it is on the internet, it will be scanned constantly for vulnerabilities.

The best defense is simple: if you are using third-party software, use only software that is still maintained, and always keep it up-to-date. PHP, apache, and wordpress are well supported and have frequent security updates, so as long as you keep them updated you shouldn't have too much to worry about from any drive-by-attacks.

If you start writing your own software though, make sure you are well versed in web application security.

The same thing also applies if you are managing your own server: a little reading on hardening a server won't hurt you. Mostly it comes down to disabling any unnecessary services, keeping the server up-to-date, and locking it down with a firewall. Still, that's just the highlights, so if you are in control of the server spend some time learning about how to secure it.

Wordpress is worth a quick mention though because (from my experience), it has a long history of security exploits. As a result, that one is very important to keep up-to-date. When I look through my own server logs and see what look like attempts at hacks, many of them are actually targeting known vulnerabilities in old versions of wordpress. At my last job we used to host the couple wordpress sites that we managed on their own server, to minimize damage in case of a hack. That server was in fact hacked once, but the source of the intrusion wasn't technically wordpress: it was actually a wordpress extension that the site-owner installed. I don't have a lot of trust for the wordpress extension store myself, although it is often a necessity to get things done if you don't know how to securely modify wordpress yourself. It makes it a bit of a catch-22: if you don't know how to write secure web application code you also don't know how to check other code to see if it is secure.