Pour plus d’information : https://nvd.nist.gov/vuln/detail/CVE-2020-8958
Un exemple de logs :
222.137.98.210 - - [29/Jul/2021:03:47:33 +0200] "GET /boaform/admin/formLogin?username=ec8&psd=ec8 HTTP/1.0" 301 650 "-" "-" 114.134.24.46 - - [29/Jul/2021:06:02:40 +0200] "GET /boaform/admin/formLogin?username=ec8&psd=ec8 HTTP/1.0" 301 650 "-" "-"
La liste des IP sur mon serveur :
# zgrep "/boaform/admin/formLogin" /var/log/apache2/access.humhub.log.*gz | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq | awk '{print "/usr/sbin/iptables -A INPUT -s " $1 " -j DROP "}'
/usr/sbin/iptables -A INPUT -s 62.171.164.100 -j DROP
/usr/sbin/iptables -A INPUT -s 93.174.89.216 -j DROP
/usr/sbin/iptables -A INPUT -s 103.145.13.120 -j DROP
/usr/sbin/iptables -A INPUT -s 111.59.6.79 -j DROP
/usr/sbin/iptables -A INPUT -s 116.24.189.232 -j DROP
/usr/sbin/iptables -A INPUT -s 125.41.13.162 -j DROP
/usr/sbin/iptables -A INPUT -s 125.44.215.247 -j DROP
/usr/sbin/iptables -A INPUT -s 134.122.43.75 -j DROP
/usr/sbin/iptables -A INPUT -s 136.144.41.150 -j DROP
/usr/sbin/iptables -A INPUT -s 143.110.208.55 -j DROP
/usr/sbin/iptables -A INPUT -s 143.198.235.203 -j DROP
/usr/sbin/iptables -A INPUT -s 143.198.66.250 -j DROP
/usr/sbin/iptables -A INPUT -s 147.182.179.241 -j DROP
/usr/sbin/iptables -A INPUT -s 147.182.179.242 -j DROP
/usr/sbin/iptables -A INPUT -s 147.182.179.243 -j DROP
/usr/sbin/iptables -A INPUT -s 147.182.179.244 -j DROP
/usr/sbin/iptables -A INPUT -s 147.182.179.245 -j DROP
/usr/sbin/iptables -A INPUT -s 165.227.42.8 -j DROP
/usr/sbin/iptables -A INPUT -s 165.232.146.19 -j DROP
/usr/sbin/iptables -A INPUT -s 167.99.184.39 -j DROP
/usr/sbin/iptables -A INPUT -s 167.99.189.51 -j DROP
/usr/sbin/iptables -A INPUT -s 205.185.115.135 -j DROP
/usr/sbin/iptables -A INPUT -s 209.141.41.11 -j DROP
/usr/sbin/iptables -A INPUT -s 209.141.41.98 -j DROP
/usr/sbin/iptables -A INPUT -s 209.141.50.63 -j DROP
/usr/sbin/iptables -A INPUT -s 209.141.54.8 -j DROP
Actuellement j’ai 198 IP qui sont blacklistés :
# cat /etc/iptables/rules.v4 | grep "DROP" | wc -l 198
Update sur cette faille :
# grep « /boaform/admin/formLogin » /var/log/apache2/access.* | sed « s/:/ /g » | awk ‘{print $2}’ | sort | uniq
198.98.56.220
199.195.251.213
199.195.253.71
209.141.56.41
# iptables -A INPUT -s 198.98.56.220 -j DROP
# iptables -A INPUT -s 199.195.251.213 -j DROP
# iptables -A INPUT -s 199.195.253.71 -j DROP
# iptables -A INPUT -s 209.141.56.41 -j DROP
# /usr/sbin/iptables-save > /etc/iptables/rules.v4