Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The past few weeks I've been seeing more and more of these probes each day. I'd like to figure out what vulnerability they're looking for but haven't been able to turn anything up with a web search.

Here's a sample of what I get in my morning Logwatch emails:

A total of XX possible successful probes were detected (the following URLs contain strings that match one or more of a listing of strings that indicate a possible exploit):

/MyBlog/?option=com_myblog&Itemid=12&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP Response 200
/index2.php?option=com_myblog&item=12&task=../../../../../../../../../../../../../../../../proc/self/environ%00 HTTP Response 200
/?option=com_myblog&Itemid=12&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP Response 301
/index2.php?option=com_myblog&item=12&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP Response 200
//index2.php?option=com_myblog&Itemid=1&task=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP Response 200

This is coming from a current CentOS 5.4 / Apache 2 box with all updates.

I've manually tried entering a few in to see what they get, but those all appear to just return the site's home page. This server is just hosting a few Joomla! sites... but this doesn't seem to be targeting Joomla (as far as I can tell).

Anyone know what they're probing for? I just want to make sure whatever it is I've got it covered (or not installed). The escalation of these entries has me a bit concerned.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

They are trying to read the environment strings for the environment. This can be obtained from /proc/self/envion, and they are walking back the directory tree to read it. It looks like Joomla is falling back to the main page when it can't process the request.

share|improve this answer
    
Is this a new thing though? Is there a specific vuln they're checking for? This particular server has been up and running for a few years now. I just started seeing these sorts of probes in the past few weeks –  Chris_K Jun 3 '10 at 13:41
    
The Internet is the Wild West; someone just has a new (to them) attack they're trying out and they are hitting your server possibly for no good reason, it's easy to Google for random Joomla sites. You could check their IP versus your usual users' IPs to see if it is actually one of them being a doofus. That kind of vulnerability is called a "directory traversal attack". Joomla has had many of these over time; maybe this newish one from Jan 2010 is what they're exercising: xforce.iss.net/xforce/xfdb/55512 –  Ernest Mueller Jun 3 '10 at 15:36
    
Thanks. I probably wasn't clear enough. I'm hip to what sort of attack it is, I'm just wondering if it relates to a new vulnerability. As I've mentioned previously, I'm seeing a rapidly escalating number of these probes each day from a wide variety of (foreign) IP addresses. –  Chris_K Jun 3 '10 at 16:51
    
I've gone from a couple a day to over 30 unique IPs doing these probes yesterday in the matter of a week. –  Chris_K Jun 4 '10 at 13:35
    
I am pretty sure this is just a directory traversal TEST and not an actual exploit, they are probably looking for LFI/RFI. –  Rook Jun 4 '10 at 20:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.