14

I am being attacked with this cgi injection:

POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1

This decodes as

//cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -d auto_prepend_file=php://input -n

Php version is 5.2.6-1+lenny13, yes thats old.

How can I prevent this attack?

5
  • 2
    Update your PHP to the latest version. You are missing out a lot. Dec 6, 2013 at 10:44
  • @Ebenezar apt-get upgrade php has nothing to do. System upgrade is not possible at the moment. Dec 6, 2013 at 10:45
  • Upgrade to at least Squeeze. Lenny is EOL and has been for a while. Dec 6, 2013 at 12:47
  • @Shadur Yes, sure this will be done at the next possible date. I needed a quick fix until then. Dec 6, 2013 at 14:16
  • 2
    This is not the only critical vulnerability that affects your system. You need to upgrade, that is the only option.
    – rook
    Dec 6, 2013 at 16:20

2 Answers 2

13

A system upgrade is required but here a quick fix.

In /etc/apache2/sites-enabled/000-default I comment out:

   ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
   <Directory "/usr/lib/cgi-bin">
           AllowOverride None
           Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
           Order allow,deny
           Allow from all
   </Directory>

And did a apache2ctl restart. Now /cgi-bin/php is not accessible anymore. That should fix it.

Wonder why this is in default anyway. You should also check other pages in sites-enabled. Do a grep "ExecCGI" /etc/apache2/sites-enabled.

1
5

Besides the obvious update everything advice, the simplest solution is don't put your php interpreter in your cgi-bin directory. In fact, don't put any interpreter in your cgi-bin directory; not php, not perl, not bash, not sed, not awk, not vi, nor any program that executes arbitrary commands passed to it.

If your hosting configuration requires that your interpreter be put in cgi-bin, then change your hosting configuration. There are plenty of reasonable alternatives that don't resort to this silly idea.

1
  • Does nginx also have a concept of cgi-bin and can it be susceptible to this attack?
    – styfle
    Sep 14, 2016 at 20:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .