Internet Information Services - CraftedSignal Threat Feed

Web Server Potential Remote File Inclusion Activity

hello@craftedsignal.io — Tue, 09 Jan 2024 18:22:34 +0000

This detection rule identifies potential Remote File Inclusion (RFI) attacks targeting web servers. RFI vulnerabilities allow attackers to inject malicious code by including remote files into the web server's application. The rule focuses on detecting HTTP GET requests with a 200 OK status code that contain suspicious URL parameters. These parameters attempt to access sensitive remote files using directory traversal techniques or directly specifying known file paths. This activity can lead to unauthorized access to sensitive information, system information disclosure, or further server compromise. The rule covers web servers like Nginx, Apache, Apache Tomcat, IIS, and Traefik. This activity is important for defenders to detect, as it can lead to significant data breaches and system compromise.

Attack Chain

Attacker identifies a vulnerable web server endpoint that is susceptible to RFI.
The attacker crafts a malicious HTTP GET request. This request includes a URL parameter (e.g., page=, url=, src=) with a URL pointing to a remote file or IP address controlled by the attacker. The URL can also leverage wrappers like php://, data://, or file://.
The victim web server receives the malicious GET request.
The web server processes the request and attempts to include the remote file specified in the URL parameter.
If the web server is vulnerable, it successfully fetches the content from the attacker-controlled remote server.
The attacker's malicious code or script within the included file is executed within the context of the web server.
The attacker gains unauthorized access to the web server's file system, configuration files, or sensitive data.
The attacker can then escalate privileges, install malware, or exfiltrate sensitive data.

Impact

Successful RFI attacks can lead to severe consequences, including unauthorized access to sensitive data, system compromise, and potential data breaches. Attackers can leverage RFI to read configuration files, gain access to credentials, and execute arbitrary code on the web server. This could result in the loss of confidential information, disruption of services, or the complete takeover of the affected system. The impact of a successful RFI attack can range from information disclosure to full system compromise, depending on the severity of the vulnerability and the attacker's objectives.

Recommendation

Deploy the Sigma rule "Web Server Potential Remote File Inclusion Activity" to your SIEM to detect suspicious GET requests containing remote URLs (see rules section).
Inspect web server logs (Nginx, Apache, Apache Tomcat, IIS, and Traefik) for GET requests with status code 200 containing parameters with encoded URLs or raw IPs.
Implement and tune WAF rules to block suspicious include parameters (e.g., page=, url=, or src=) containing http://, https://, ftp://, smb://, or file://.
Restrict outbound connections from web servers to known, trusted domains to prevent exploitation of RFI vulnerabilities.
Set PHP allow_url_include=Off and allow_url_fopen=Off in PHP configuration files to mitigate RFI vulnerabilities.
Apply open_basedir restrictions in PHP to limit the files that PHP scripts can access.

Web Server Remote File Inclusion Activity Detected

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

This rule identifies potential Remote File Inclusion (RFI) attacks against web servers, specifically targeting Nginx, Apache, Apache Tomcat, IIS, and Traefik. The detection logic focuses on HTTP GET requests that receive a 200 OK response and include URL parameters that contain remote URLs or raw IP addresses. The rule is designed to detect attempts to exploit RFI vulnerabilities, where attackers try to force the application to fetch external content or reveal local files. The rule uses esql and url decoding to normalize the request before checking for suspicious URL schemes and IP addresses. The minimum stack version is 9.2.0 to support the esql url_decode() operator.

Attack Chain

The attacker identifies a web server running a vulnerable application (e.g., PHP application on Apache).
The attacker crafts a malicious HTTP GET request containing a URL parameter (e.g., page) designed to exploit an RFI vulnerability.
The malicious GET request includes a remote URL (e.g., http://203.0.113.10/drop.txt) or an IP address within the vulnerable parameter.
The web server processes the request and attempts to fetch the remote content specified in the URL.
If successful (HTTP 200 OK), the remote content is included in the web server's response.
The attacker leverages the inclusion of the remote file to execute arbitrary code or access sensitive information.
The attacker uses the RFI to further compromise the web server, potentially installing a webshell or exfiltrating data.

Impact

A successful RFI attack can lead to the disclosure of sensitive information, arbitrary code execution, and complete compromise of the web server. This can result in data breaches, service disruption, and reputational damage. The elastic rule considers attacks against Nginx, Apache, Apache Tomcat, IIS, and Traefik web servers, impacting any organizations utilizing these platforms.

Recommendation

Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
Block the identified malicious IP 203.0.113.10 at the firewall or intrusion prevention system based on its context as an example RFI probe.
Investigate any alerts generated by these rules, focusing on the url.original field in the logs to understand the attempted RFI.

Web Server Discovery or Fuzzing Activity Detected

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This rule detects potential reconnaissance activity against web servers, specifically web server discovery or fuzzing. The activity is characterized by a single source IP address generating a high volume of HTTP GET requests that result in 404 (Not Found) or 403 (Forbidden) status codes within a short time period. The logic is based on analysis of web server logs from Nginx, Apache, Apache Tomcat, IIS, and Traefik. Such patterns typically indicate an attacker is trying to discover hidden or unlinked resources, potentially identifying vulnerabilities or sensitive information disclosure points on the web server. This discovery phase can often precede more targeted attacks. The detection logic triggers when more than 500 events from a single source IP are observed, involving more than 250 distinct URL requests.

Attack Chain

The attacker initiates a connection to the target web server using an automated tool.
The attacker sends a large number of HTTP GET requests to the web server, probing various URLs and paths.
The web server responds to the requests, often returning 404 (Not Found) or 403 (Forbidden) status codes for non-existent or restricted resources.
The attacker analyzes the HTTP response codes to identify potentially accessible or vulnerable resources.
If accessible resources are found (e.g., administrative interfaces, backup files), the attacker attempts to access them.
The attacker may attempt further exploitation based on discovered vulnerabilities or accessible resources.
The attacker gains unauthorized access to the web server or sensitive data.
The attacker performs malicious activities such as data theft, defacement, or system compromise.

Impact

Successful web server discovery and fuzzing can lead to the identification of sensitive files (e.g., configuration files, backups), vulnerable endpoints (e.g., administrative interfaces), and insecure configurations. An attacker can leverage this information to gain unauthorized access, leading to data breaches, system compromise, or service disruption. The severity of the impact depends on the nature of the exposed resources and the attacker's capabilities.

Recommendation

Deploy the Sigma rule Web Server Fuzzing Detection to your SIEM and tune the threshold based on your environment's baseline traffic to reduce false positives.
Review web server logs for patterns matching the description in the Overview to identify potential attackers.
Implement rate limiting on your web servers and WAF to mitigate the impact of web server discovery and fuzzing attempts, based on the analysis of http.request.method and http.response.status_code.
Ensure that sensitive files and directories are properly secured and not publicly accessible, reviewing access control configurations on the web server.
Monitor web server logs for requests to common sensitive paths (e.g., /.env, /.git, /admin), using a rule targeting the url.original field, to detect unauthorized access attempts.

Web Server Discovery or Fuzzing Activity

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection identifies web server reconnaissance and fuzzing attempts. The rule is triggered when a single source IP address generates a high volume of HTTP GET requests that result in 404 (Not Found) or 403 (Forbidden) status codes within a short period. This behavior suggests an attacker is trying to discover hidden or unlinked resources on a web server, a common initial step before more targeted attacks. This is achieved by counting events and distinct URLs accessed from logs across Nginx, Apache, Apache Tomcat, IIS, and Traefik web servers. The rule triggers if more than 500 events and 250 distinct URLs are observed from a single IP address within the monitored timeframe.

Attack Chain

The attacker initiates network connections to a target web server (Nginx, Apache, etc.).
The attacker sends a series of HTTP GET requests to various URLs, often using a wordlist.
The web server processes each request and returns HTTP status codes.
The attacker analyzes the HTTP status codes to identify existing resources.
A large number of 404 (Not Found) or 403 (Forbidden) responses indicate a fuzzing attempt.
The attacker identifies potentially vulnerable or misconfigured resources.
The attacker may attempt to exploit discovered vulnerabilities.
Successful exploitation could lead to information disclosure or unauthorized access.

Impact

Successful web server discovery enables attackers to map out a web application's structure and identify potential vulnerabilities or misconfigurations. This reconnaissance can precede more severe attacks, such as unauthorized access to sensitive data, code execution, or denial-of-service attacks. While this rule has low severity, successful reconnaissance can lead to high impact outcomes.

Recommendation

Deploy the Sigma rule High Volume of 404/403 GET Requests to your SIEM and tune the threshold (events > 500 and URLs > 250) for your environment.
Investigate any alerts generated by the Sigma rule to identify the source IP address and the target web server, then check the associated logs.
Review WAF/CDN logs for rate limiting and blocks related to the suspicious source IP, as recommended in the overview.
Implement rate limiting on web servers to mitigate the impact of web server discovery and fuzzing attempts, as mentioned in the overview.
Harden the web tier by disabling directory listing and default app endpoints, blocking patterns like /.git/, /.env, and /backup.zip at the WAF, and restricting origin access to CDN egress only, as mentioned in the overview.