I found what looks like a possible attempted Shellshock attack targeting
tmUnblock.cgi, and I'm trying to understand it.
I was checking through Apache access logs for a small webserver during the time period between the Shellshock bug becoming news and the server being patched, looking for suspicous entries.
It gets low traffic, so it's actually possible for me to read through the whole access log and spot unusual entries. These are mostly "white hat" scans such as Errata Security's "Shellshock Scan of the Internet", with the Shellshock attempts visible in the log entry through being present in the user agent.
One, however, looks like it might be a more serious attack attempt:
184.108.40.206 - - [26/Sep/2014:18:16:48 -0400] "GET /" 400 464 "-" "-" 220.127.116.11 - - [26/Sep/2014:18:16:48 -0400] "GET /tmUnblock.cgi HTTP/1.1" 400 303 "-" "-"
There's about 4 of these in my logs, all from different IPs, all from after Shellshock was publicised. Their IPs all come from odd, unrelated sources that seem plausible for bots.
The first appears to be a scan (testing vulnerability?), then there's an attempt to target a cgi script. Unlike the white hat stuff like the Erratta Security scan, there's nothing giving away its purpose in the user agent (my understanding is that 'serious' Shellshock attacks will use headers that are not logged).
I've never heard of
tmUnblock.cgi and it doesn't appear to exist on my server, so I'm mostly asking out of curiosity (I hope!). What is
tmUnblock.cgi and is it something that could be targetted with a shellshock attack?
My own attempts to research tmUnblock.cgi ended in confusion. It seems associated with an exploitable bug in Linksys routers discovered in Feb 2014, which seems to be related to executing shell commands and seems to have been used to propagate worms in the past, but that's all I can find.