/ Register

Welcome to Centmin Mod Community
Become a Member

NGINX making bad requests after upgrade to 1.27.2

Discussion in 'System Administration' started by KlueMaster, Dec 7, 2024.

Tags:
Previous Thread Next Thread
Loading...
  1. Dec 7, 2024 #1
    KlueMaster

    KlueMaster Member

    78
    11
    8
    Aug 5, 2017
    Ratings:
    +32
    Local Time:
    11:33 PM
    MariaDB 10
    Hello,

    BotNinja has reported malicious requests originating from my server, in the communication below:

    I'm unable to figure out how to locate the malicious script and remove it. Any help will be appreciated.

    Thanks!
     
  2. Dec 7, 2024 #2
    eva2000

    eva2000 Administrator Staff Member

    58,905
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    4:03 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    That wouldn't be related to Nginx 1.27.2 upgrade. You can verify by downgrading to previous Nginx version or upgrade to Nginx 1.27.3 and see. If still happens, then you need to find out if your server has been compromised in some way.

    What web apps are you running on the server? OS version? CentOS 7 which is EOL https://centminmod.com/centos7eol and no more updates or security fixes or AlmaLinux/Rocky Linux
     
  3. Dec 7, 2024 #3
    KlueMaster

    KlueMaster Member

    78
    11
    8
    Aug 5, 2017
    Ratings:
    +32
    Local Time:
    11:33 PM
    MariaDB 10
    It was actually a malware attack on the WordPress sites hosted on the server.

    There server is on CentOS 7 EOL. Unfortunately, I don't have an alternate server to back it up and change OS. It hosts some WordPress sites, and a couple of Laravel apps (which were thankfully unaffected).

    Malware seems to target block editor of WordPress. However, I'm unsure how it is able to do it.

    After removing the infected files, and upgrading the NGINX to 1.27.3, the problem seems to have got resolved for now.
     
  4. Dec 7, 2024 #4
    buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    8:03 PM
    Perhaps not the post you will like to read, but unfortunately I can't sugarcoat it.

    In the very short term, is your Wordpress installation up-to-date, including themes, plugins and any custom code? And for Centminmod, are you using the latest software, PHP, MariaDB etc alongside Nginx?

    The future and long term.
    The only solution is to keep both the server software as well as the website software up-to-date.
    Of course make regular backups so you can always go back, should there is more damage, than originally thought.

    Since a bot works automatically and is not manual human work, this bot and other bots are going to try to infect your system multiple times again, over and over again with multiple exploits.

    Since CentOS 7 and CentOS 7 Centminmod is end of life, there is simply no choice, you will have to migrate once. Your system will get weaker and weaker over time because there will be no more updates at the security level, but more and more new software code leaks will become known all the time.
     
  5. Dec 7, 2024 #5
    KlueMaster

    KlueMaster Member

    78
    11
    8
    Aug 5, 2017
    Ratings:
    +32
    Local Time:
    11:33 PM
    MariaDB 10
    I understand that part. Somehow yum updates have also stopped working though. Wordpress installations, themes and plugins are all up-to-date. However, some plugins may be not as secure as others (such as File Manager).
     
  6. Dec 7, 2024 #6
    buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    8:03 PM
    That's because of the fact that the packages are archived as of June 30, 2024.
    Up-to-date in the sense of last code updated by author days ago or from i.e. last update in year 2022? Should a developer have stopped his project, Wordpress indicates up-to-date, which in fact, the code it is not.

    Can't you rent a server for days or request a free server for migration? Some providers help their regular customers with that kind of migrations services.
     
  7. Dec 7, 2024 #7
    eva2000

    eva2000 Administrator Staff Member

    58,905
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    4:03 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    True though, it's highly unlikely CentOS 7 is responsible for compromised Wordpress install. More likely the Wordpress install itself i.e. outdated Wordpress plugins are the culprit.
     
  8. Dec 8, 2024 #8
    buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    8:03 PM
    Of course and that's why I raise Wordpress first at 'the very short term'.
    But as I also wrote for the 'future', I think end of life CentOS 7 should really be looked at. If the system as a whole is continued at the current rate, I consider it downright likely that in the long run you'll be doing clean-ups (i.e. malicious code removal) every week/day. And that means the system will be exploited via both Wordpress code, as well as the OS.
     
Previous Thread Next Thread
Loading...

.