5

There are a lot of requests like this in our logs:

[07/Dec/2015:19:37:03 +0000] "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\!
x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01" 400 172 "-" "-" "-"

I guess this a security vulnerability, but I could not find with Google. Has anyone else seen this or know what it is?

Improve this question
6
  • 1
    Welcome to wild internet. Someone sends bad request to you and nginx send 400 error code back. It's OK.
    – Alexey Ten
    Dec 8, 2015 at 8:33
  • But you might want to find out IP who send these requests and contact with them to stop it. Or just firewall these request, or do something else
    – Alexey Ten
    Dec 8, 2015 at 8:42
  • Thanks. These are coming from China or Taiwan. We are not worried about these requests, only curious which application's which vulnerability they are trying to exploit.
    – user3145800
    Dec 9, 2015 at 1:32
  • 4
    Directly related on security.se : Server attack with \x01
    – Autar
    Jun 1, 2016 at 13:44
  • This is pretty normal. In the future you can mitigate malicious attacks with tools like fail2ban instead of worrying about manual firewall rules.
    – Signus
    Feb 15, 2017 at 23:28

3 Answers 3

Reset to default
2

It may be an attempt at exploiting a security vulnerability, but there is nothing in that log entry suggesting your server is vulnerable.

The client isn't speaking HTTP. It's just sending a sequence of bytes which all have value 1. If it was HTTP it would be interpreted as ASCII characters, and the 1 byte in ASCII is a rarely used control character, which has no meaning in HTTP.

It could be an attempt to exploit a buffer overflow, but if that's the case it would appear your server rejected the request as invalid before it even got to the malicious payload. On a vulnerable server it is quite likely nothing would have been logged.

The 400 in the log indicates that your server rejected the request as invalid. That's because a stream of 1 bytes isn't a valid HTTP method, and besides it's way too long.

An answer to a related question on a sister site points out that this kind of request may also be an attempt at fingerprinting your server to find out what software it is running.

Improve this answer
1

Looks like someone is requesting some shellcode from your webserver.

I'd usually just ignore it, but if it's causing a problem with logging or something, ban them.

Do a quick Whois on their IP address and if it's a university, report it to the abuse@ email with logs ;)

Improve this answer
0

Maybe you had set proxy_pass https://upstream; while your upstream server was just listening on http port, if the upstream server was also an nginx server, its access log would be like what you have posted above.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.