Unauthorized access attempts to sensitive files (error_log, .env, etc.) across multiple paths

[DiegoRatto]

Description

Performing wazuh/wazuh#27180 (comment) multiple unauthorized access attempts (HTTP error code 401) are being logged for sensitive files, such as error logs (error_log) and configuration files (.env). These attempts include access to common paths and other critical locations, such as /wp-content/, /errors/, and /wp-includes/. The logs indicate that these requests are coming from the same IP address (51.222.26.42) and using an outdated browser Chrome 56.

Dec 09 03:01:45 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:01:45Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/errors/.env","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /errors/.env 401 1ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/wp-content/uploads/error_log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":0,"contentLength":9},"message":"GET /wp-content/uploads/error_log 401 0ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/error_log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /error_log 401 1ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/wp-content/plugins/plugin-name/error_log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":0,"contentLength":9},"message":"GET /wp-content/plugins/plugin-name/error_log 401 0ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/logs/wp-content/uploads/error_log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /logs/wp-content/uploads/error_log 401 1ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/logs/error.log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":0,"contentLength":9},"message":"GET /logs/error.log 401 0ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/logs/wp-content/themes/theme-name/error_log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /logs/wp-content/themes/theme-name/error_log 401 1ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/logs/wp-content/plugins/plugin-name/error_log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /logs/wp-content/plugins/plugin-name/error_log 401 1ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/administrator/logs/error_log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /administrator/logs/error_log 401 1ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/administrator/logs/error.php","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /administrator/logs/error.php 401 1ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/var/logs/error.log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /var/logs/error.log 401 1ms - 9.0B"}

Dec 09 03:03:04 wazuh-server opensearch-dashboards[11129]: {"type":"response","@timestamp":"2024-12-09T03:03:04Z","tags":[],"pid":11129,"method":"get","statusCode":401,"req":{"url":"/sites/default/error_log","method":"get","headers":{"host":"34.207.220.229","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36","accept":"*/*"},"remoteAddress":"51.222.26.42","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /sites/default/error_log 401 1ms - 9.0B"}

Sample Requests

• /wp-content/error_log - Response 401
• /wp-content/uploads/error_log - Response 401
• /wp-content/themes/theme-name/error_log - Response 401
• /errors/.env - Response 401
• /error/.env - Response 401

Additional Details:

• HTTP Method: GET
• Response Code: 401 (Unauthorized)
• IP Address: 51.222.26.42
• User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
• Response Times: Most requests show very fast response times, indicating little processing or that many requests are being sent in quick succession.

[c-bordon]

These messages are in a way expected, the test machines are exposed to the public network, which means they can receive some attack, the messages indicate a connection attempt with incorrect credentials, and the message is not an error.

This configuration will not be modified from DevOps. The test machines are ephemeral and do not require any additional configuration to avoid this type of behavior at the moment.