14

I am being attacked with this cgi injection:

POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1

This decodes as

//cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -d auto_prepend_file=php://input -n

Php version is 5.2.6-1+lenny13, yes thats old.

How can I prevent this attack?

  • 2
    Update your PHP to the latest version. You are missing out a lot. – Ebenezar John Paul Dec 6 '13 at 10:44
  • @Ebenezar apt-get upgrade php has nothing to do. System upgrade is not possible at the moment. – PiTheNumber Dec 6 '13 at 10:45
  • Upgrade to at least Squeeze. Lenny is EOL and has been for a while. – Shadur Dec 6 '13 at 12:47
  • @Shadur Yes, sure this will be done at the next possible date. I needed a quick fix until then. – PiTheNumber Dec 6 '13 at 14:16
  • 2
    This is not the only critical vulnerability that affects your system. You need to upgrade, that is the only option. – rook Dec 6 '13 at 16:20
13

A system upgrade is required but here a quick fix.

In /etc/apache2/sites-enabled/000-default I comment out:

   ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
   <Directory "/usr/lib/cgi-bin">
           AllowOverride None
           Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
           Order allow,deny
           Allow from all
   </Directory>

And did a apache2ctl restart. Now /cgi-bin/php is not accessible anymore. That should fix it.

Wonder why this is in default anyway. You should also check other pages in sites-enabled. Do a grep "ExecCGI" /etc/apache2/sites-enabled.

5

Besides the obvious update everything advice, the simplest solution is don't put your php interpreter in your cgi-bin directory. In fact, don't put any interpreter in your cgi-bin directory; not php, not perl, not bash, not sed, not awk, not vi, nor any program that executes arbitrary commands passed to it.

If your hosting configuration requires that your interpreter be put in cgi-bin, then change your hosting configuration. There are plenty of reasonable alternatives that don't resort to this silly idea.

  • Does nginx also have a concept of cgi-bin and can it be susceptible to this attack? – styfle Sep 14 '16 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.