8

Recently, I have got a few 404 errors where the user has requested PHP pages.

The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of the request.

%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E

Which translates to something like:

-d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on+-d+disable_functions=""+-d+open_basedir=none+-d+auto_prepend_file=php://input+-d+cgi.force_redirect=0+-d+cgi.redirect_status_env=0+-n

I do not have cgi-bin or php folders exposed so I am not overly concerned about these requests but I am curious as to what they are looking for to ensure I am patched up.

1 Answer 1

5

All of the exploit boards are exploding with the recent Apache + PHP 5.x remote code execution vulnerability. Every HTTP server on the planet is getting hit with this right now.

6
  • remove code execution vulnerability :) ... the script you linked feels like 2001. Commented Nov 6, 2013 at 7:25
  • Thanks for the link - How do I determine if I am vulnerable without running the linked script?
    – Kami
    Commented Nov 6, 2013 at 10:04
  • @that guy from over there yeah CGI injection, thats bizzare. Its actually the 2nd variant of this attack, one very similar to it came out a few years ago.
    – rook
    Commented Nov 6, 2013 at 16:22
  • iirc it was also part of that latest plesk-thingie, i see the scanners going around every then and there. Commented Nov 6, 2013 at 18:32
  • @Kami: you might check if /cgi-bin/php[3,4,5] is a valid path on your server. if so, you might check some of the URLS given in Rook's link (use GET, not POST) Commented Nov 6, 2013 at 18:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .