2

After a surge in network activity, checking the logs of Apache that's serving a casual minimal WordPress site, through a Cloudflare proxy, I see the following entry repeated hundreds of times:

172.71.98.180 - - [22/Aug/2022:01:59:06 +0000] "POST /wp-content/plugins/the-social-links/assets/css/font-awesome.min.css HTTP/1.1" 302 565 "-" "Mozilla/5.0 (X11; U; Linux i686; pl; rv:1.8.1.2) Gecko/20070220 Firefox/2.0.0.2"

Now, HTTP attacks are not news to me, but the strange things is that this attack is targeting a CSS resource with a POST request.

How can this be useful to the attacker in any possible way?

Improve this question
1
  • 2
    In theory the generation of CSS files could be done by an application dynamically - therefore the application could be vulnerable to POST requests. However, I haven't seen any such application yet.
    – Tero Kilkanen
    Aug 22, 2022 at 16:33

1 Answer 1

Reset to default
2

The only thing I could think off:

When a CDN is implemented, like Cloudflare, then GET requests for static resources are offloaded to the CDN.

A POST request on the other hand will (often) still be forwarded to a back-end server.

That means more traffic and load for the back-end server and potentially impact the service.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .