Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was told the below, from SecurityMetrics that this must be resolved. However, there is no cgi-bin or perl file in that path.

When we perform the following http://www.domain.com/cgi-bin/perl in the URL it pulls a 500 internal server error. Please direct this to a 404 not found alone; otherwise, the vulnerability appears valid.

Perl.exe When we perform the following http://www.domain.com/cgi-bin/perl.exe in the URL it pulls a 500 internal server error. Please direct this to a 404 not found alone; otherwise, the vulnerability appears valid.

They also said:

We do understand that it may not exist but please have your site show that. An internal server error does not prove that the file doesn't exist. A 404 not found does.

How can I do that? I'm using PHP 5.2.9 / Apache 2.2 / Centos 4.8

share|improve this question
1  
You're going to have to look at your server log (both access and error) to see what it's doing when they hit that URL. Where are you looking for /cgi-bin/perl? Check your ScriptAlias and make sure you're looking in the right folder –  DerfK Mar 10 '11 at 0:27
3  
Lol - a 404 not found doesn't prove anything. –  Joel Coel Mar 10 '11 at 2:05
    
I hope you do understand that despite being told this must be resolved, it's really up to you whether you do or don't. I personally would because 500 is the wrong error to return but you're under no obligation to do the same. –  John Gardeniers Mar 10 '11 at 3:09
    
Something is messed up on your server, it shouldn't be returning 500 errors for files that don't exist. The answers below might get you past this test, but it certainly sounds like something is really wrong. –  Chris S Mar 10 '11 at 3:10

2 Answers 2

The easiest way to do this is with a mod_rewrite rule. Check this into your .htaccess

RewriteRule /cgi-bin/perl.exe  - [R=404,L]
RewriteRule /cgi-bin/perl  - [R=404,L]

(technically 404 is not a valid response code for mod_rewrite to be sending out, but it works)

share|improve this answer
    
That didn't work. –  Chad Mar 11 '11 at 13:43

Install modsecurity and add the following rule:

SecRule ARGS perl.exe "phase:1,log,deny,status:404"

Not only will you "comply" with this audit (yeah I know), but you will have a full fledged WAF protecting you against many issues you may have in your application.

share|improve this answer
    
That didn't work either. –  Chad Mar 11 '11 at 13:44
    
I did check the logs and see this: ModSecurity: Access denied with code 500 (phase 2). Pattern match "perl" at REQUEST_URI. [file "/usr/local/apache/conf/modsec2.user.conf"] [line "368"] [hostname "www.mydomain.com"] [uri "/cgi-bin/perl"] [unique_id "TXomXZPKQgIAAHSLIZAAAAAM"] –  Chad Mar 11 '11 at 13:47
    
Did you configure modsecurity with the CRS (core rule set) or did you start with a "blank" configuration? –  jliendo Mar 11 '11 at 13:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.