1

Someone requested my site's (Wordpress/Apache) 'includes' directory:

122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-"

Noticing the 200 response, I hit the URL myself and found the contents readily visible, with navigable subdirectories as well.

open directory listing

With the common sentiment that raw directory access is a massive security faux pas, I first assumed this is no exception.

However a huge Wordpress hole like this is unlikely to remain unnoticed for over a decade; now I'm curious... why isn't it a vulnerability? The plugin and theme directories don't allow this same access.

(or did I just trip over yet more proof that many eyes doesn't necessarily make a bug shallow?)

Searching hasn't turned up any explanations--only examples of malicious code found within hacked sites. Part of me is tempted to tear through all my 90 kajillion sites, inserting redirects into index.html files.

Can someone please assuage my paranoia and talk me out of second-guessing this? What's the rationale for allowing this access? And if it's harmless--why did a random IP request it?


Followup after comment below:

So these directories probably shouldn't be viewable from the outside, but Ghedipunk made a good point that the Wordpress code is open source and thereby no secret. Maybe no big deal.

But it appears to be a bit more than curiosity. I ran a grep for this IP on the entire /var/log and got only results for includes/Text/Diff/.

No other URLS aside that one, not even delving into directories. And on several sites--not all the domains on this server were hit, but it at least resembles targeted traffic:

siteA.com 122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-"
siteB.com 122.51.0.219 - - [03/Oct/2019:19:12:19] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-"
siteC.com 122.51.0.219 - - [03/Oct/2019:17:18:41] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 741 "-" "-"
siteD.com 122.51.0.219 - - [03/Oct/2019:14:43:20] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-"
siteE.com 122.51.0.219 - - [03/Oct/2019:17:18:04] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 732 "-" "-"

Then again--by comparing found files with public Wordpress source, one could deduce the WP version and decide which attacks to attempt next.

  • Faux pas, yes... but not a vulnerability. Anyone can see the source code for Wordpress, and there shouldn't be anything accessible to the web server that you don't want the world to access (even if such access attempts immediately give a 403 or prompt a user to log in). -- As for why they accessed it; they might be a bot scanning for vulnerable plugins, or a curious user who happens to use your server to satisfy their curiosity. – Ghedipunk Oct 3 at 19:31
  • Thanks. If you post an answer I'll accept it. Updated the question after digging for that IP in all the Apache logs. Still not terribly concerned, but it looks a bit more systematic than curiosity. – zedmelon Oct 3 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.