0

I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php

This is the notification:

-------------------------------
Request:
-------------------------------

 * URL        : http://\localhost/admin/config.php
 * HTTP Method: GET
 * IP address : 92.118.39.180
 * Parameters : {"path"=>"admin/config", "format"=>"php"}
 * Timestamp  : 2022-04-05 08:09:43 UTC
 * Server : master-server
   * Rails root : /home/app/releases/20220404140039
 * Process: 23693

-------------------------------
Session:
-------------------------------

 * session id: nil
 * data: {}

-------------------------------
Environment:
-------------------------------

 * HTTP_ACCEPT                                            : */*
   * HTTP_HOST                                              : \localhost
   * HTTP_USER_AGENT                                        : gbrmss/7.29.0
   * HTTP_VERSION                                           : HTTP/1.1
   * ORIGINAL_FULLPATH                                      : /admin/config.php
   * ORIGINAL_SCRIPT_NAME                                   :
   * PASSENGER_CONNECT_PASSWORD                             : [FILTERED]
   * PATH_INFO                                              : /admin/config.php
   * QUERY_STRING                                           :
   * REMOTE_ADDR                                            : 92.118.39.180
   * REMOTE_PORT                                            : 61001
   * REQUEST_METHOD                                         : GET
   * REQUEST_URI                                            : /admin/config.php
   * ROUTES_18000_SCRIPT_NAME                               :
   * SCRIPT_NAME                                            :
   * SERVER_NAME                                            : \localhost
   * SERVER_PORT                                            : 80
   * SERVER_PROTOCOL                                        : HTTP/1.1
   * SERVER_SOFTWARE                                        : nginx/1.14.0 Phusion_Passenger/6.0.12
   * action_dispatch.authenticated_encrypted_cookie_salt    : authenticated encrypted cookie
   * action_dispatch.backtrace_cleaner                      : #<Rails::BacktraceCleaner:0x00005555cd55bbf8>
   * action_dispatch.content_security_policy                :
   * action_dispatch.content_security_policy_nonce_generator:
   * action_dispatch.content_security_policy_report_only    : false
   * action_dispatch.cookies                                : #<ActionDispatch::Cookies::CookieJar:0x00005555cbf2a370>
   * action_dispatch.cookies_digest                         :
   * action_dispatch.cookies_rotations                      : #<ActiveSupport::Messages::RotationConfiguration:0x00005555c9a2c348>
   * action_dispatch.cookies_serializer                     :
   * action_dispatch.encrypted_cookie_cipher                :
   * action_dispatch.encrypted_cookie_salt                  : encrypted cookie
   * action_dispatch.encrypted_signed_cookie_salt           : signed encrypted cookie
   * action_dispatch.http_auth_salt                         : http authentication
   * action_dispatch.key_generator                          : #<ActiveSupport::CachingKeyGenerator:0x00005555ce54c0d0>
   * action_dispatch.logger                                 : #<ActiveSupport::Logger:0x00005555ccc21c18>
   * action_dispatch.parameter_filter                       : [:password]
   * action_dispatch.redirect_filter                        : []
   * action_dispatch.remote_ip                              : 92.118.39.180
   * action_dispatch.request.content_type                   :
   * action_dispatch.request.parameters                     : {"path"=>"admin/config", "format"=>"php"}
   * action_dispatch.request.path_parameters                : {:path=>"admin/config", :format=>"php"}
   * action_dispatch.request.query_parameters               : {}
   * action_dispatch.request.request_parameters             : {}
   * action_dispatch.request.unsigned_session_cookie        : {}
   * action_dispatch.request_id                             : ddb38c2e-d7b5-4976-acfa-1b1f5c31347d
   * action_dispatch.routes                                 : #<ActionDispatch::Routing::RouteSet:0x00005555cd075828>
   * action_dispatch.secret_key_base                        : 1360asdfadd6350b4asdf9149d6b092a19fa51620asdfb525b424f3340deb5871c5bf0dc6065848adsfb5d46ef6fabc5c1421a5basdf14f4e8e6b557828e286b5fced4f5asdf2301eac4969asdf9
   * action_dispatch.secret_token                           : 5539e6524a3c9abddea0804a772141d7cafdd11a488c5ce4279514344c183854a47ed79b72f8ae10d2e6d9b2aab58cd940aab690bd7738182091405b09db5ab8
   * action_dispatch.show_detailed_exceptions               : false
   * action_dispatch.show_exceptions                        : true
   * action_dispatch.signed_cookie_digest                   :
   * action_dispatch.signed_cookie_salt                     : signed cookie
   * action_dispatch.use_authenticated_cookie_encryption    : false
   * rack.errors                                            : #<IO:0x00005555c89cb828>
   * rack.hijack                                            : #<Proc:0x00005555cc0fb938 /usr/lib/ruby/vendor_ruby/phusion_passenger/rack/thread_handler_extension.rb:94 (lambda)>
   * rack.hijack?                                           : true
   * rack.input                                             : #<PhusionPassenger::Utils::TeeInput:0x00005555cc0fba00>
   * rack.multiprocess                                      : true
   * rack.multithread                                       : false
   * rack.request.cookie_hash                               : {}
   * rack.request.query_hash                                : {}
   * rack.request.query_string                              :
   * rack.run_once                                          : false
   * rack.session                                           : #<ActionDispatch::Request::Session:0x00005555cc5c06f8>
   * rack.session.options                                   : #<ActionDispatch::Request::Session::Options:0x00005555cc5c04c8>
   * rack.tempfiles                                         : []
   * rack.url_scheme                                        : http
   * rack.version                                           : [1, 2]
   * warden                                                 : Warden::Proxy:170380 @config={:default_scope=>:user, :scope_defaults=>{}, :default_strategies=>{:user=>[:token_authenticatable, :rememberable, :database_authenticatable], :customer=>[:rememberable, :database_authenticatable]}, :intercept_401=>false, :failure_app=>#<Devise::Delegator:0x00005555ce9a87f0>}

Why does Rails think the domain is \localhost when the request comes from a remote connection? How could that have been faked?

My NGINX config only accepts requests for certain domains. I don't know if this is a security issue. Btw: there is no PHP installed on that server.

2
  • Is the IP address in your question relevant? You might want to consider removing it as it is PII
    – Tvde1
    Commented Apr 7, 2022 at 11:22
  • @Tvde1 It's not like it's removed from the edit history anyways
    – user163495
    Commented Apr 7, 2022 at 11:39

1 Answer 1

2

Rails thinks the domain is "\localhost" because that's what the client asked for.

In order to support virtual hosting (hosting more than one website on a single computer), HTTP since version 1.1 supported the "Host:" header, where the client indicates which domain they want. For example, to access "security.stackexchange.com", you'd make a connection to 151.101.193.69 and send the following request:

GET / HTTP/1.1
Host: security.stackexchange.com

To access "history.stackexchange.com", you'd connect to the same IP address, but your request would look like

GET / HTTP/1.1
Host: history.stackexchange.com

The request to your server looked something like this:

GET /admin/config.php HTTP/1.1
Host: \localhost

which is a request for the "/admin/config.php" file on a virtual server answering to the name "\localhost". Presumably this is an attacker probing for an incorrectly-configured server that doesn't require authentication for local requests; the fact that you got exception notification suggests that the probe failed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .