0

I have a ubuntu server (Ubuntu 22.10 x64) on Digital Ocean. And I am using fastapi, uvicorn, gunicorn and nginx as I used it for my backend api calls from my frontend and my frontend IP is dynamic.

Recently, I have been getting unknown remote login and calls and not sure why it's 127.0.0.0.1. It seems like attacks. I tried installing clamav, Chkrootkit, Linux Malware Detect package now, but it still seems to get hit. I attached all the logs below.

How can I prevent these attacks from coming through again? I wanted to only allow incoming calls from my domain, but I am not sure how to do that.

Here is the random log I got.

> INFO: 127.0.0.1:57478 - "GET /geoserver/web/ HTTP/1.1" 404 Not Found
> INFO: 127.0.0.1:39908 - "GET /.git/config HTTP/1.1" 404 Not Found

> INFO: 127.0.0.1:35108 - "GET /remote/login HTTP/1.1" 404 Not Found
> INFO: 127.0.0.1:57210 - "GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1" 404 Not Found

> INFO: 127.0.0.1:57592 - "POST /FD873AC4-CF86-4FED-4FED-4BD59C6F17A7 HTTP/1.1" 404 Not Found

> INFO: 127.0.0.1:38462 - "GET /.env HTTP/1.1" 404 Not Found
> INFO: 127.0.0.1:38478 - "POST / HTTP/1.1" 404 Not Found

> INFO: 127.0.0.1:45248 - "GET /ReportServer HTTP/1.1" 404 Not Found

> INFO: 127.0.0.1:55602 - "GET /autodiscover/autodiscover.json@zdi/Powershell HTTP/1.1" 404 Not Found

enter image description here

2
  • Please post the log as text, not as screenshots. Text is better to read and to search.
    – ThoriumBR
    Jun 30, 2023 at 1:07
  • Noted. Thank you. I have updated the question.
    – felix
    Jun 30, 2023 at 3:58

1 Answer 1

0

It looks like the attacker is doing information gathering from SSRF Attack.

The web app you have developed is vulnerable to SSRF. The attacker can trick the web application into making requests to internal resources.

Example: https://your-app.com?view=https://example.com/example.png

where you want to load external images from the remote server and show its content in the web-app

An attacker can make a request to internal resources using

https://your-app.com?view=http://localhost:8000/.env

4
  • How do I prevent this ?
    – felix
    Jun 30, 2023 at 13:41
  • Hope this helps cheatsheetseries.owasp.org/cheatsheets/…
    – Akshay
    Jun 30, 2023 at 17:35
  • will look into it. Thank you. Will using ufw by allowing incoming only from my frontend and blocking the rest ?
    – felix
    Jul 1, 2023 at 0:19
  • No, it will not help. You have to fix your application to not be subject to SSRF.
    – ThoriumBR
    Nov 27, 2023 at 18:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .