8

Recently, I have got a few 404 errors where the user has requested PHP pages.

The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of the request.

%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E

Which translates to something like:

-d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on+-d+disable_functions=""+-d+open_basedir=none+-d+auto_prepend_file=php://input+-d+cgi.force_redirect=0+-d+cgi.redirect_status_env=0+-n

I do not have cgi-bin or php folders exposed so I am not overly concerned about these requests but I am curious as to what they are looking for to ensure I am patched up.

6

All of the exploit boards are exploding with the recent Apache + PHP 5.x remote code execution vulnerability. Every HTTP server on the planet is getting hit with this right now.

  • remove code execution vulnerability :) ... the script you linked feels like 2001. – that guy from over there Nov 6 '13 at 7:25
  • Thanks for the link - How do I determine if I am vulnerable without running the linked script? – Kami Nov 6 '13 at 10:04
  • @that guy from over there yeah CGI injection, thats bizzare. Its actually the 2nd variant of this attack, one very similar to it came out a few years ago. – rook Nov 6 '13 at 16:22
  • iirc it was also part of that latest plesk-thingie, i see the scanners going around every then and there. – that guy from over there Nov 6 '13 at 18:32
  • @Kami: you might check if /cgi-bin/php[3,4,5] is a valid path on your server. if so, you might check some of the URLS given in Rook's link (use GET, not POST) – that guy from over there Nov 6 '13 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.