Someone requested my site's (Wordpress/Apache) 'includes' directory:
126.96.36.199 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-"
Noticing the 200 response, I hit the URL myself and found the contents readily visible, with navigable subdirectories as well.
With the common sentiment that raw directory access is a massive security faux pas, I first assumed this is no exception.
However a huge Wordpress hole like this is unlikely to remain unnoticed for over a decade; now I'm curious... why isn't it a vulnerability? The plugin and theme directories don't allow this same access.
(or did I just trip over yet more proof that many eyes doesn't necessarily make a bug shallow?)
Searching hasn't turned up any explanations--only examples of malicious code found within hacked sites. Part of me is tempted to tear through all my 90 kajillion sites, inserting redirects into index.html files.
Can someone please assuage my paranoia and talk me out of second-guessing this? What's the rationale for allowing this access? And if it's harmless--why did a random IP request it?
Followup after comment below:
So these directories probably shouldn't be viewable from the outside, but Ghedipunk made a good point that the Wordpress code is open source and thereby no secret. Maybe no big deal.
But it appears to be a bit more than curiosity. I ran a grep for this IP on the entire /var/log and got only results for includes/Text/Diff/.
No other URLS aside that one, not even delving into directories. And on several sites--not all the domains on this server were hit, but it at least resembles targeted traffic:
siteA.com 188.8.131.52 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-" siteB.com 184.108.40.206 - - [03/Oct/2019:19:12:19] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-" siteC.com 220.127.116.11 - - [03/Oct/2019:17:18:41] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 741 "-" "-" siteD.com 18.104.22.168 - - [03/Oct/2019:14:43:20] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-" siteE.com 22.214.171.124 - - [03/Oct/2019:17:18:04] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 732 "-" "-"
Then again--by comparing found files with public Wordpress source, one could deduce the WP version and decide which attacks to attempt next.