Pour plus d’information : https://perchsecurity.com/perch-news/cve-spotlight-mobileiron-rce-cve-2020-15505/

Exemple d’un logs :

45.146.165.123 - - [24/Jun/2021:03:49:36 +0200] "POST /mifs/.;/services/LogService HTTP/1.1" 302 5371 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.146.165.123 - - [24/Jun/2021:03:49:46 +0200] "GET /user/auth/login HTTP/1.1" 200 13385 "-/mifs/.;/services/LogService" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

J’ai donc fait :

# zgrep "/mifs/." /var/log/apache2/access.humhub.log.*gz | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq | awk '{print "iptables -A INPUT -s " $1 " -j DROP "}'
iptables -A INPUT -s 45.146.165.123 -j DROP

Vu qu’il y avait qu’une seule IP, j’ai pas fait de script:

# iptables -A INPUT -s 45.146.165.123 -j DROP
# iptables-save > /etc/iptables/rules.v4

A suivre.