2

I see this in my WP statistics: Screenshot

Is it safe to click on the link? Under what conditions will the script be triggered?

  • 3
    No don't click the link. – schroeder Apr 18 '15 at 13:48
3

It should be safe to click (although I still wouldn't).

It looks like the attacker tried to exploit the shellshock vulnerability. If your server is vulnerable, the script will already be executed, you calling it again doesn't add that much harm (in this case, you don't have any more rights than the attacker has, assuming you are not viewing the log from the server).

Of course, clicking the link doesn't gain you any knowledge either, and generally, it's a bad idea to click on links in your log (because of XSS), so don't click on it, and check if you are vulnerable to shellshock.

|improve this answer|||||
  • Hi. Thanks for the answer. I have tested my server against shellshock before it was not vulnerable. I am just worried that the script can still be somehow executed by some WP plugins that try to analyse the visitors. Do such possibilities exist? – paradite Apr 19 '15 at 8:00
  • @paradite no, as long as none of the plugins feed the log data to functions such as system or passthru, there is no way for them to accidentally trigger the script. And I would assume that none of them do that, because it doesn't make any sense and would obviously be a huge security issue. – tim Apr 19 '15 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.