0

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails.

wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

They have been attacking random domain that is hosted on my server. Most of my website is using a .NET based framework, only a few websites are running on Wordpress. And all the Wordpress ones do not use this revslider_show_image plugin.

I don't know the definition for this attack (maybe DoS?), but would like some advice on how to fix this issues.

Currently, I just block the IP address using this method, but I'm not sure it will help.


This is a reply from Symantec, that doesn't really help much:

You will see that many of these URLs end with "../wp-config.php". This appears to be a Wordpress exploit of some kind.

I think you should take the following actions:

3

What you're seeing is automated probing for security holes in your website. Currently, attacks that try to retrieve the contents of wp-config.php are the big thing; other popular targets are phpMyAdmin and php-cgi.

For probes like these, either you're vulnerable (and have probably already been successfully attacked) or you're not vulnerable (and have nothing to worry about). In your case, since you're not running "revslider_show_image", you fall into the "not vulnerable" group.

You can block the IP addresses the probes are coming from, but it won't do much good: the computers involved are almost certainly part of a botnet, and the real attacker has tens of thousands of these machines to work with. The best thing you can do is remove unneeded software and make sure the rest of it is kept up-to-date.

  • Thanks for the advised. Is there a way to stop automated probing (or reduce) or ban them upon do detected as a whole server? This is because probing my server seems like not healthy. For the past few days, I am receiving this warning about 100++ per day so my management is abit worried. – user2056901 Sep 16 '14 at 6:50
  • 1
    It's quite possible to automatically block these probes, though the method depends on the details of your setup. There's not much benefit, though: what you're seeing is essentially the "background noise" of the Internet, and it's the job of commercial security software to make you think that noise is a major problem, so you'll keep paying them for their software. – Mark Sep 16 '14 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.