How does a website get pass my server firewall and attempt to hotlink to my server resources?

Question

I was stumped when I saw the following lines on my Apache server error log this morning:

[authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: /var/www/styles/style.css, referer: http://bd.adm.ijinshan.com/adm.html?adm=somehexdec&t=timestamp [authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: /var/www/scripts/script.js, referer: http://bd.adm.ijinshan.com/adm.html?adm=somehexdec&t=timestamp

I might have accessed some forum which triggers the site to contact my web server. But my server has a firewall that is configured explicitly to allow access only from a few internal ip addresses. I suspect it could be the following line in my iptables config that allows them to access my server:

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Is it true that if I inadvertently contacted the server by accessing a hidden iframe in some forum that I am allowing the website to access my server? How did it guess the location of my script and stylesheet given that there could be thousands of path combinations? And what is the intention of trying to hotlink to them? Could this be malicious? The website seems like some antivirus company in China.

UPDATE:

Going into the server access log, I found the following line:

127.0.0.1 GET /adm.html?adm=somehexdec&t=timestamp HTTP/1.1 404 http://snippet.pos.baidu.com/bfp/snippetcacher.php?qn=somehexdec

Ok, now I understand that my server issued a 404 custom error page (obviously because there is no adm.html) which contains the script and css file. That part of the mystery is solved. And also, my firewall rules seems to work correctly since the ip address 127.0.0.1 represents localhost.

Now the problem is identifying why accessing that page on baidu triggers a lookup on my localhost and whether this is a security issue.

Answer 1

If your access.log states that there is a connection to your Web server from localhost (127.0.0.1) then this means that some process running on the same server machine did that connection. If you are running a Web browser on the same machine, then that Web browser could be the culprit. Similarly, if your server is not the same machine as your desktop system, but you use that server as a proxy for your browser (SOCKS proxy, Web proxy, VPN...) then all your browsing activity will actually show up as connections from your server.

I suppose you are in one of the two situations described above. Now suppose that, with your Web browser, you browse a page (say, on a Web forum) which contains, in its HTML, this:

<img src="http://localhost/adm.html?adm=somehexdec&t=timestamp" />

then your browser will dutifully try to load the data at that URL, and, due to your own network configuration, the name "localhost" will be resolved from your server, and point to itself. Hence the log entries.

---

Now, what could be the point of such a link ? Well, it could plausibly be an attack attempt. Conceivably, there is a software system, somewhere, which technically runs as a local Web server, accepting connections from localhost only, with an "administrative" interface for connections to "/adm.html" file. If someone running such a system on his machine browses a Web page which contains the "localhost" link shown above, then his own browser will issue an administrative command to his software, command chosen by whomever put the Web page together.

Apparently you do not run such software (since your own server does not know of any "adm.html" and responds with a 404). The attack is not against you. However, this does highlight the limitations of firewall-based security in a Web context: Web pages that you browse can make your browser do connections to arbitrary other machines, including "localhost", without your consent, and since these connections come from your machine, they will likely go through your own firewall rules.

(In that case, this can be seen as an example of Cross-site request forgery, the target site being "localhost".)