You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Der PCFreak <ma...@pcfreak.de> on 2019/09/12 15:40:30 UTC
[Guacamole hack attack?]
Hi,
by accident I found the following in my very reduced Apache SSL Error logs:
```
[Thu Sep 05 02:35:53 2019] [error] [client xxx.xxx.xxx.xxx] Invalid URI
in request GET
/dana-na/../dana/html5acc/guacamole/../../../../../../../etc/hosts?/dana/html5acc/guacamole/
HTTP/1.1
```
The thing is, I do not host Guacamole to the public internet, neither on
this machine.
I just wanted to inform the list, that it might be the case that someone
found a vulnerability in Guacamole and tries to find public vulnerable
servers.
I am also interested in any information regarding this log entry.
Kind regards
Peter
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: [Guacamole hack attack?]
Posted by "Евгений Н. Жуков" <eu...@gmail.com>.
Apache returned [error]
чт, 12 сент. 2019 г. в 18:40, Der PCFreak <ma...@pcfreak.de>:
> Hi,
>
> by accident I found the following in my very reduced Apache SSL Error logs:
>
> ```
> [Thu Sep 05 02:35:53 2019] [error] [client xxx.xxx.xxx.xxx] Invalid URI
> in request GET
> /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/hosts?/dana/html5acc/guacamole/
>
> HTTP/1.1
> ```
>
> The thing is, I do not host Guacamole to the public internet, neither on
> this machine.
>
> I just wanted to inform the list, that it might be the case that someone
> found a vulnerability in Guacamole and tries to find public vulnerable
> servers.
>
> I am also interested in any information regarding this log entry.
>
>
> Kind regards
>
>
> Peter
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
> For additional commands, e-mail: user-help@guacamole.apache.org
>
> --
Евгений Жуков
+79534155676 skype: xrt_nn
Re: [Guacamole hack attack?]
Posted by Rafael Ramos <ra...@gmail.com>.
Hello,
CVE-2019-11510: Pre-auth Arbitrary File Reading
https://nvd.nist.gov/vuln/detail/CVE-2019-11510
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/
Em qui, 12 de set de 2019 às 13:07, Nick Couchman <vn...@apache.org>
escreveu:
> On Thu, Sep 12, 2019 at 11:40 AM Der PCFreak <ma...@pcfreak.de>
> wrote:
>
>> Hi,
>>
>> by accident I found the following in my very reduced Apache SSL Error
>> logs:
>>
>> ```
>> [Thu Sep 05 02:35:53 2019] [error] [client xxx.xxx.xxx.xxx] Invalid URI
>> in request GET
>> /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/hosts?/dana/html5acc/guacamole/
>>
>> HTTP/1.1
>> ```
>>
>> The thing is, I do not host Guacamole to the public internet, neither on
>> this machine.
>>
>> I just wanted to inform the list, that it might be the case that someone
>> found a vulnerability in Guacamole and tries to find public vulnerable
>> servers.
>>
>>
> First, if you think you've found a vulnerability in Guacamole, please make
> sure to report it responsibly:
>
> https://www.apache.org/security/
>
> This involves reporting it *privately* to the project, not publicly on the
> lists.
>
> That said, in your case, if your Guacamole instance is not hosted
> publicly, then I would be concerned that whatever network it is hosted on
> has something bad on it - the kind of attack you're seeing there looks less
> like an attack specific to Guacamole and more like a generic case of
> someone finding a valid URL and then trying to exploit a poorly-configured
> system to get access to system-level files. The good news, for you, is
> that it appears that your Apache server is seeing it as an invalid
> request. The bad news is that something is trying to do it in the first
> place. Whatever client is represented by the redacted "[client
> xxx.xxx.xxx.xxx]" should probably be investigated for malware and/or threat
> actors present on the system.
>
> -Nick
>
Re: [Guacamole hack attack?]
Posted by Mike Jumper <mj...@apache.org>.
On Thu, Sep 12, 2019 at 10:58 PM Der PCFreak <ma...@pcfreak.de>
wrote:
> ...
>
> The latter made me thinking about sending an email to the list because why
> would someone go exactly for a path containing `guacamole`. Well it just
> might be that the attacker read [this document](
> https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf)
> from Blackhat 2019 where it is listed as an example on page 80. (btw. very
> interesting document...)
>
My guess would be that the vulnerable component of Pulse Secure happens to
be used to serve the static files of Guacamole, thus the path needs to
appear to point to Guacamole for the vulnerable part of Pulse Secure to be
handed the request. The query string ending with ".../guacamole/" looks
like an attempt to exploit naive request validation.
As Nick noted, while this case happens to deal with a vulnerability
specific to Pulse Secure and not Guacamole, please use the (private)
security@guacamole.apache.org list going forward if you're seeing something
that appears to have security implications. If this had turned out to be a
problem with Guacamole, and that problem had been unknown until now, then
you would have just publicly disclosed a security issue with no
immediately-available fix, to the dismay of anyone hosting the software.
- Mike
Re: [Guacamole hack attack?]
Posted by Der PCFreak <ma...@pcfreak.de>.
Hi,
thanks for all the feedback. I really think this was just a random hit
by someone scanning the internet and I can live with that.
The only thing I'd like to mention is, that the request
- came from a public IP
- the server does not and has never hosted any instance of Guacamole
The latter made me thinking about sending an email to the list because
why would someone go exactly for a path containing `guacamole`. Well it
just might be that the attacker read [this
document](https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf)
from Blackhat 2019 where it is listed as an example on page 80. (btw.
very interesting document...)
Anyway, nothing happened, server is secured let's move to the important
things of life.
Regards
Peter
On 12.09.2019 18:07, Nick Couchman wrote:
> On Thu, Sep 12, 2019 at 11:40 AM Der PCFreak <mailinglists@pcfreak.de
> <ma...@pcfreak.de>> wrote:
>
> Hi,
>
> by accident I found the following in my very reduced Apache SSL
> Error logs:
>
> ```
> [Thu Sep 05 02:35:53 2019] [error] [client xxx.xxx.xxx.xxx]
> Invalid URI
> in request GET
> /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/hosts?/dana/html5acc/guacamole/
>
> HTTP/1.1
> ```
>
> The thing is, I do not host Guacamole to the public internet,
> neither on
> this machine.
>
> I just wanted to inform the list, that it might be the case that
> someone
> found a vulnerability in Guacamole and tries to find public
> vulnerable
> servers.
>
>
> First, if you think you've found a vulnerability in Guacamole, please
> make sure to report it responsibly:
>
> https://www.apache.org/security/
>
> This involves reporting it *privately* to the project, not publicly on
> the lists.
>
> That said, in your case, if your Guacamole instance is not hosted
> publicly, then I would be concerned that whatever network it is hosted
> on has something bad on it - the kind of attack you're seeing there
> looks less like an attack specific to Guacamole and more like a
> generic case of someone finding a valid URL and then trying to exploit
> a poorly-configured system to get access to system-level files. The
> good news, for you, is that it appears that your Apache server is
> seeing it as an invalid request. The bad news is that something is
> trying to do it in the first place. Whatever client is represented by
> the redacted "[client xxx.xxx.xxx.xxx]" should probably be
> investigated for malware and/or threat actors present on the system.
>
> -Nick
Re: [Guacamole hack attack?]
Posted by Nick Couchman <vn...@apache.org>.
On Thu, Sep 12, 2019 at 11:40 AM Der PCFreak <ma...@pcfreak.de>
wrote:
> Hi,
>
> by accident I found the following in my very reduced Apache SSL Error logs:
>
> ```
> [Thu Sep 05 02:35:53 2019] [error] [client xxx.xxx.xxx.xxx] Invalid URI
> in request GET
> /dana-na/../dana/html5acc/guacamole/../../../../../../../etc/hosts?/dana/html5acc/guacamole/
>
> HTTP/1.1
> ```
>
> The thing is, I do not host Guacamole to the public internet, neither on
> this machine.
>
> I just wanted to inform the list, that it might be the case that someone
> found a vulnerability in Guacamole and tries to find public vulnerable
> servers.
>
>
First, if you think you've found a vulnerability in Guacamole, please make
sure to report it responsibly:
https://www.apache.org/security/
This involves reporting it *privately* to the project, not publicly on the
lists.
That said, in your case, if your Guacamole instance is not hosted publicly,
then I would be concerned that whatever network it is hosted on has
something bad on it - the kind of attack you're seeing there looks less
like an attack specific to Guacamole and more like a generic case of
someone finding a valid URL and then trying to exploit a poorly-configured
system to get access to system-level files. The good news, for you, is
that it appears that your Apache server is seeing it as an invalid
request. The bad news is that something is trying to do it in the first
place. Whatever client is represented by the redacted "[client
xxx.xxx.xxx.xxx]" should probably be investigated for malware and/or threat
actors present on the system.
-Nick