1

I am getting a lot of spam GET and POST requests lately which some of them look like this:

"GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0"

and:

"\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 173 "-" "-"

As far as I know these are trying known vulnerabilities in bulk but I am unsure.

So in my case where I only have a single html file with nothing but text and a link in an up-to-date Debian server with NGINX, are they still pose a security threat? if yes how?

Thanks!

Improve this question
4
  • 1
    "So in my case where I only have a single html file with nothing but text and a link in an up-to-date Debian server with NGINX, are they still pose a security threat? if yes how?" - probably it is not a problem for you. But, it is not so much about what you intend to do (serve a static html file) but what your server is able to do based on your setup. Even if your goal is only to serve static html files you might have enabled features which can be used to attack your server, even though you don't need these features for static html files.
    – Steffen Ullrich
    Commented May 16, 2021 at 18:38
  • @SteffenUllrich "based on your setup" Is the default NGINX config vulnerable? What are the ways to defend against these attacks/exploits?
    – user257368
    Commented May 16, 2021 at 19:35
  • 1
    Does this answer your question? Is my server being used as a proxy or being attacked?
    – mentallurg
    Commented May 16, 2021 at 19:52
  • @fedqx: "Is the default NGINX config vulnerable?" - which default config you are talking about? I don't think that there is such a thing. There might be default configurations with various packaging of nginx (i.e. different Linux distributions etc) but there is no overall default. "What are the ways to defend against these attacks/exploits?" - in general: keep your configuration as minimal as needed. If you want to serve only static files make sure that's all what can be done with the config.
    – Steffen Ullrich
    Commented May 16, 2021 at 20:16

1 Answer 1

Reset to default
1

No vulnerabilities are typically not shared across different software or hardware platforms or even different versions of the affected software. What you posted appears to be a precursor or exploitation attempt for CVE-202-25078, a D-LINK router vulnerability. Typically any IP address on the internet receives a lot of nuisance traffic trying to collect information that once lived on that IP address, looking for proxy servers, guessing passwords or various exploits. Many of which come from botnets that take no care to determine if what they are targeting may in fact be something suitable to send the traffic to. This is normal internet background traffic and not a threat to your server.

Improve this answer
1
  • Thanks! It was really bothering me, now I can just ignore them. Edit: BTW sorry for late response.
    – user257368
    Commented May 17, 2021 at 12:01

You must log in to answer this question.