4

I recently came across some entries in nginx's access logs that resemble the following:

##.##.##.## - - [24/Sep/2014:01:21:51 -0400] "GET /767/browser-wars-side-show-ho
w-natty-handles-the-load/+++++++++[+%C0%EA%F2%E8%E2%E0%F6%E8%FF+]+Result:+%E8%F1
%EF%EE%EB%FC%E7%EE%E2%E0%ED+%ED%E8%EA%ED%E5%E9%EC+%22azazalolxd%22;+%E2%EE%F8%EB
%E8;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%E
A%E8; HTTP/1.0" 400 0 "http://2buntu.com/767/browser-wars-side-show-how-natty-ha
ndles-the-load/+++++++++[+%C0%EA%F2%E8%E2%E0%F6%E8%FF+]+Result:+%E8%F1%EF%EE%EB%
FC%E7%EE%E2%E0%ED+%ED%E8%EA%ED%E5%E9%EC+%22azazalolxd%22;+%E2%EE%F8%EB%E8;+%ED%E
5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;" "Mo
zilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/
35.0.1916.153 YaBrowser/14.7.1916.15705 Safari/537.36"

There were about 10 of these requests within a span of about a minute. I noticed that the requests came from many different IP addresses, though the user-agent was identical.

Is this an attempt to exploit a known vulnerability? Nginx seems to be suspicious and returns an HTTP 400 response. One thing I noticed within the requested path is the string:

"azazalolxd"

That's pretty suspicious for a "random" sequence of characters.

Should I be concerned? The requests seem to have stopped for the time being.


Edit: I decided to try unescaping some of the entities and came up with the following:

%C0%EA%F2%E8%E2%E0%F6%E8%FF = Àêòèâàöèÿ
%E8%F1%EF%EE%EB%FC%E7%EE%E2%E0%ED+%ED%E8%EA%ED%E5%E9%EC+%22 = èñïîëüçîâàí
...

They seem to all be Latin-1 extended characters. Is this some form of Unicode attack?

3

The url encodes a Windows Codepage 1251 encoded string, containing (harmless) russian error messages. The transcoded url is:

/767/browser-wars-side-show-how-natty-handles-the-load/+++++++++[+Активация+]+Result: использован никнейм "azazalolxd"; вошли; не нашлось формы для отправки;

Google translator gives:

[ activation ] Result: used the nickname "azazalolxd"; included; can not find the form to send;

Its consistent with the usage of the russian Yandex browser that has this useragent. Also see this question.

0

If you have coded your application to properly sanitize user input, encode special characters before they get to the back-end, and reject data that is unexpected, you should have nothing to worry about.

  • That's rather generic—true for any web application at all times. – Anko Sep 24 '14 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.