2

I have a Magento 404 question:

This generic product url looks like this http://www.domain.com/some-magento-product.html

But from a security standpoint. how would a request to something like this be treated:

GET /bulkhead-abs-thread-x-thread-1-45713f6ff2041d3fdfae927b82488db8.html+Result:+%E8%F1%EF%EE%EB%FC%E7%F3%E5%EC+SOCKS+192.168.0.90:10045;+%E8%F1%EF%EE%EB%FC%E7%EE%E2%E0%ED+%ED%E8%EA%ED%E5%E9%EC+%22aidajy1%22;+

Now, I know on the apache level that a 404 appears to be generated and the client is served your generic ‘not found’ page.

But, would/could Magento itself act on that request in addition to the 404 that’s seen at the client end?

  • Why did someone downvote this question? What did I do wrong? – brentwpeterson Mar 12 '15 at 21:10
  • 1
    No idea, it's a good & legit question from my point of view. – Anna Völkl Mar 13 '15 at 8:00
3

This request would make it to Magento (if SEO URL rewrites are enabled):

https://github.com/OpenMage/magento-mirror/blob/magento-1.9/.htaccess#L169

The URL Encoded string has some funky characters most likely in hopes of escaping and attempting to connect to a local socket 192.168.0.90:10045 with some argument of aidajy1

���������� socks 192.168.0.90:10045; ����������� ������� "aidajy1";

If you are worried about someone accessing, it would be wise to start tailing log files and doing some code audits and grep scans over the FS to see if theres any possible back doors installed.

Is a pretty common signature, but realize there are countless ways, so take the search with a grain of salt or as use case example:

Locate eval(gzinflate [common signature for hiding backdoors/exploits] recursively for PHP exploits (all file types)

find . -type f -name '*' -printf '"%p"\n' | xargs grep --no-messages -l "eval*(gzinflate" --color
  • 1
    Thanks @BOOMER - I ran your command and got a xargs error at first, I added the -printf and it worked. – brentwpeterson Mar 13 '15 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.