By gonefishing on

I'm using BB2 ( badbehavior2 ). Today I had the following in the log files:

403  Request contained a malicious JavaScript or SQL injection attack  2007-11-14 18:09:40 72.14.193.1 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; IEMB3; IEMB3) 

The code used:
/node/4124#comment-477

Headers:
GET /node/4124#comment-477 HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Accept-Encoding: gzip Accept-Language: en-us Cookie: PHPSESSID=554c98325f86ae95927204be27b834bc; bb2_screener_=1195063773+72.14.193.1+86.106.50.55 Host: www.mysite.com Referer: http://www.mysite.com/node/4124 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; IEMB3; IEMB3) X-Forwarded-For: 86.106.50.55 X-moz: prefetch 

IP Whois =  72.14.193.1 - - [20/May/2007:12:38:06 +0200] "GET /images/cs.gif HTTP/1.1" 200 546 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Google Wireless Transcoder;)"

IP Whois = 86.106.32.0/19 inetnum:        86.106.32.0 - 86.106.63.255 
 netname:        SC-UPC-ROMANIA-SA 
 descr:          SC UPC Romania SA 
 descr:          str. Herastrau 17 
 descr:          Bucuresti 1 
 country:        ro 
 admin-c:         AH1598-RIPE 
 tech-c:          MA190-RIPE 
 status:         ASSIGNED PA 
 remarks:        Registered trough http://www.jump.ro/ip.html 
 mnt-by:          RO-MNT 
 mnt-lower:       RO-MNT 
 mnt-routes:      ASTRALTELECOM-MNT 
 source:         RIPE  Filtered 
 person:         Astral Telecom Hostmaster 
 address:        Astral Telecom SA 
 address:        ROMANIA 
 phone:          40 264 414688 
 fax-no:         40 264 414687 
 e-mail:         hostmaster@astral.ro

Is this a known security issue? The code used almost stopped the server from responding.

Regards

⋅ Categories: Drupal 4.7.x

Comments

drumm’s picture

drumm
he/him
Location NY, US
commented

/node/4124#comment-477 is not malicious. It is the standard URL to get the 477th comment on the site, which happens to be on the 4124th piece of content.

I see nothing malicious in this report and suspect it is a false positive. In the future, please report a security issue using http://drupal.org/contact, and do not publicly post potential vulnerabilities.