Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Suspect requests in fastapi app deployed in EC2 instance.

0

Hello, I have an ec2 instance that hosts a fastapi app. It is supposed to be accessed through Route53 -> Application Load Balancer -> EC2 Instance path. Note: The instance hosts a couple of apps, accessed through a couple of load balancers. Inbound rules:

TypeProtocolPort rangeSourceDescription
SSHTCP220.0.0.0/0
All trafficAllAllsg-080capplication-loadbalancer1SecurityGroup from applicationloadbalancer1SecurityGroup:ALL TRAFFIC
All trafficAllAllsg-03d2application-loadbalancer2SecurityGroup from applicationloadbalancer2SecurityGroup:ALL TRAFFIC
All trafficAllAllsg-0b36application-loadbalancer3SecurityGroup from applicationloadbalancer3SecurityGroup:ALL TRAFFIC

The logs show someone trying to find things related passwords, redirecting to a URL "https://interact.sh" and other weird requests. I want to know if it's something that comes from AWS, as a security check, or if maybe there's some malicious intent. Thank you. The suspect logs look like this(I added only a snipped, but have the full logs if required):

  • INFO: 172.31.7.6:9612 - "GET /wabam HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9616 - "GET /ui/vault/auth?with=oidc%2F HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9612 - "GET /vsaas/v2/login HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9616 - "GET /login/?next=/ HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9616 - "GET //fckeditor/_samples/default.html HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9612 - "GET //ckeditor/samples/plugins/htmlwriter/outputhtml.html HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:28218 - "GET /app/outside.html HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:54830 - "GET /vr2conf/login.html HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9616 - "GET /home.html HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9616 - "GET //ckeditor/samples/ HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:28218 - "GET //editor/ckeditor/samples/sample_posteddata.php HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9612 - "GET //editor/ckeditor/samples/ HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:9612 - "GET //fckeditor/editor/filemanager/connectors/uploadtest.html HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57394 - "GET /static/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini
  • INFO: 172.31.7.6:57394 - "GET /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57406 - "GET /mantisbt-2.3.0/verify.php?id=1&confirm_hash HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57394 - "GET /index.php?op=fileviewer&file=/etc/passwd HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57406 - "GET /__raw/services/server/info/server-info?output_mode=json HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57394 - "GET /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57406 - "GET /jkstatus%3B HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57394 - "GET /server/node_upgrade_srv.js?action=downloadFirmware&firmware=/../../../../../../../../../../Windows/win.ini HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57406 - "PUT /meta HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57406 - "GET /laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57394 - "GET /zimbra/h/search?si=1&so=0&sfi=4&st=message&csi=1&action&cso=0&id=%22%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57374 - "GET /message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E%3B HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57414 - "GET /login?next=http://interact.sh/?app.scan/ HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57394 - "GET /assets/php/filebrowser/filebrowser.main.php?file=../../../../../../../../../../etc/passwd&do=download HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57414 - "GET /IntellectMain.jsp?IntellectSystem=https://www.interact.sh HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57394 - "GET //www.interact.sh HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57394 - "POST /filemanager/upload.php HTTP/1.1" 404 Not Found
  • INFO: 172.31.7.6:57414 - "GET /webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152 HTTP/1.1" 404 Not Found
Topics
ComputeAWS Well-Architected Framework
Tags
Amazon EC2Network SecuritySecurity
Language
English
asked a year ago498 views
1 Answer
0

Hello.

Looking at the logs, I thought that the access was not from AWS.
I recommend checking the ALB access logs to find out where the access is coming from.
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

There is a possibility that some kind of web crawling tool is being used, so you may want to consider blocking it with something like AWS WAF.
https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html
https://repost.aws/knowledge-center/report-aws-resource-crawling

EXPERT
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content