Fourteen years and still knocking
A bare web address logged 14,141 requests. Three hundred were POSTs and seventy-seven carried a body, nearly all of them the same query-string trick against PHP running as CGI, a flaw disclosed in May 2012. The rest of the traffic is not hunting an application at all: it asks for dotfiles, git config and cloud credentials.
This exploit is fourteen years old. It still arrives every day.
Old bugs are supposed to fade out. Patched, shipped, forgotten.
Fourteen thousand requests on an address with nothing on it. Three hundred are posts, and seventy-seven carry an actual body.
Nearly all of those are the same shape: a query string that smuggles command line switches into PHP running as a CGI program. Percent A D is a soft hyphen. Decoded, it becomes a dash, and the dash turns what follows into flags.
That flaw was disclosed in May, two thousand twelve.
The rest is not hunting an application at all. It asks for dot env, git config, cloud credentials.
Nobody expects it to land. It costs nothing to try, and the internet is large enough that somewhere it still does.
Do not serve dotfiles, and do not run PHP as CGI.
#linux#security#php#infosec#sysadmin
❯ Do not serve dotfiles, and do not run PHP as CGI.