We're hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is monitored through a protected dynamic (AJAX) UI, which displays a real-time stream of image previews which include the uuid in the URL, something like:
When I trawl through the Apache access logs I see requests to some of these image URLs from a small number of third party IP addresses, fairly consistently originating from either Amazon AWS EC2 instances in the US or "Bayer Business Services GmbH" in Germany, according to iplocation.net.
The question is how these image URLs are leaking out so that third parties are able to request them?
The URLs aren't aren't listed anywhere, so wouldn't be found by any crawling/scraping process looking at the site. The fact that they include a uuid means that even if a third party had the base URL (the "
https://<SERVER>/<root>/image" prefix) it would be pretty much impossible to guess a valid uuid to append.
My guess so far would be one of the following:
- The browser I'm using to monitor the site might be leaking request URLs to external parties, maybe for supposedly innocent reasons. However, I'm seeing these "URL leaks" whether I'm using Chrome or Firefox.
- Some other process on the monitoring PC is leaking request URLs, for example maybe Bitdefender shares a selection of request URLs with their servers for safety checking (blacklisting) purposes. However these leaked URL requests are often 1 or 2 days after the original valid request, so this would imply that Bitdefender (or other) would have to be saving URLs for days and re-testing later.
- Something on the server is leaking the URLs, which in practice would point the finger at Apache 2.4.x. That would seem like a major security loophole, if Apache was able to send out request URLs to external services. Very unlikely I'd have thought.
In practice the server is pretty well protected so these leaks are unlikely to cause real damage. Apache is Docker containerised, running under Linux, and fairly well isolated from the database and host. All web traffic is https, and unauthenticated requests are trapped and responded to with an http 404, so the Apache logs show a 404 for these "leaked URLs".
Nevertheless this seems somewhat sinister, that either a browser, browser extension, or server component such as Apache could be pushing out request URLs to some unknown external third parties, who can then reissue those request URLs for unknown purposes.
Can anyone explain how this is happening?