0

I received this in my Magento 1.9.2.3 error.log file just one time. I have been searching and reading but I'm still not sure I have a handle on what this means:

[11-Feb-2016 08:08:52 America/New_York] PHP Warning: shell_exec() has been disabled for security reasons in /MyServer/public_html/500.php on line 13

I see line 13 in 500.php is: echo$fixer;

with line 10-12 being: <?
  echo "URL: http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']."<br>\n";
  $fixer = "checksuexec ".escapeshellarg($_SERVER['DOCUMENT_ROOT'].$_SERVER['REQUEST_URI']);

I see in php.ini the line:

disable_functions = proc_open,phpinfo,show_source,system,shell_exec,passthru,exec,popen

So, I think I get that something in my set-up tried to do something, shell_exec, that this line disallows.

I have no idea how to figure out what tried to do that, and also, I'm not clear if I need to do anything in response to this error at this point.

It has only appeared the 1 time. But once it appears, has that disabled some function that I need to re-enable or respond to in some way or is it just that something in my set-up tried to execute this function, this line in php.ini did not allow it to do it, and that's the end of it at this point?

I'm just trying to understand. If I've left out any details/info, let me know and I will update.

Thanks in advance!!

1

The file 500.php isn't even part of magento and that line you posted looks like a backdoor to me. Be very glad your php.ini had shell_exec disabled for security reasons. Most likely the reason you only saw this error once is because whatever hacker tried to use it tried it only once and gave up when he/she saw it didn't work.

I would delete the file 500.php and thoroughly investigate how someone was able to upload it on your server. You probably have another unpatched vulnerability somewhere.

  • I'm pretty sure 500.php is a hosting server file that was in public_html from the beginning. The entire contents of the file are: <!-- PHP Wrapper - 500 Server Error --> <html><head><title>500 Server Error</title></head> <body bgcolor=white> <h1>500 Server Error</h1> A misconfiguration on the server caused a hiccup. Check the server logs, fix the problem, then try again. <hr> <? echo "URL: http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']."<br>\n"; $fixer = "checksuexec ".escapeshellarg($_SERVER['DOCUMENT_ROOT'].$_SERVER['REQUEST_URI']); echo $fixer; ?> </body></html> – Classic Feb 12 '16 at 3:21
  • If it was really just a legitimate 500 error page it wouldn't be calling shell_exec. – Christian Feb 12 '16 at 21:34
  • I confirmed with my Hosting company that this is a system file. Customer support said, "That means that a 500 error occurred (which means there was a configuration issue on the site or something went wrong at that time) and it produced that error message when trying to load that file. If the issue is not reoccurring, it's nothing to be concerned about." When I said it had occurred more than once, they said,"It's an indication that something in your site is producing that error, so if you are having the problem repeatedly you would just need to edit your php.ini file." – Classic Feb 17 '16 at 5:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.