Why is my web site being scanned for license.txt, and should I be worried?

Question

Lately I am seeing multiple daily 404s for variations of "license.txt", e.g., "wordpress/license.txt", "blog/license.txt", "old/license.txt", "new/license.txt". Here's a little snippet of slightly redacted logfile to illustrate:

5.189.164.217 - - [17/Apr/2020:11:12:30 -0700] "GET [redacted]/wordpress/license.txt HTTP/1.1" 404 562 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" etc.
[...]
158.181.48.29 - - [17/Apr/2020:14:46:47 -0700] "GET [redacted]/w/license.txt HTTP/1.1" 404 554 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" etc.
[...]
178.254.50.202 - - [17/Apr/2020:18:45:12 -0700] "GET [redacted]/blog/license.txt HTTP/1.1" 404 557 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" etc.
[...]
217.11.48.184 - - [17/Apr/2020:22:51:10 -0700] "GET [redacted]/b/license.txt HTTP/1.1" 404 554 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" etc.

This specific day the IP addresses all appear to originate from Germany, but this is not the case generally.

Why these repeated GETs for variations license.txt? Is there some known vulnerability being scanned for here? Like if a site responds with a certain license.txt, that is a sign to the client that there's some exploitable vulnerability? Is this something to worry about?

Answer 1

That's just some normal Internet background noise from automated scans, and as they result in 404 Not Found, you shouldn't be worried. The license.txt, readme.html etc. are scanned because they may contain version information, which may lead to finding some unpatched vulnerabilities.

That's not the only place such information could leak from: <meta name="generator" might contain version information, WordPress adds ?ver=X.Y.Z parameters to linked CSS and JS files etc. You could remove such hints, but the best solution would be updating the core, all plugins and all themes regularly, and possibly automate the updates. (Not that you'd even have WordPress installed, but the same applies to any CMS & webapp.)