up vote 0 down vote favorite
share [g+] share [fb]

I received about 50 messages today with the similar message:

WordPress Firewall has detected and blocked a potential attack!

Web Page: domain.com/index.php?option=com_simpledownload&controller=../../../../../../../../../../../../../../../proc/self/environ%00 Warning: URL may contain dangerous content! Offending IP: 211.147.221.42 [ Get IP location ] Offending Parameter: controller = ../../../../../../../../../../../../../../../proc/self/environ

This may be a "Directory Traversal Attack."

How much should I worry about these? It came from multiple IP addresses throughout the day.

link|improve this question
100% accept rate
Harmless. These type of requests are quite normal. And that "wordpress firewall" thing is probably useless... – One Trick Pony Dec 12 '11 at 2:52
That is what I was thinking, but I had to ask. – Mike Wills Dec 12 '11 at 2:55
feedback

2 Answers

up vote 4 down vote accepted

This is very common, it is a malicious query string most likely (99% time) done by a bot, I think option=com_simpledownload is actually a Joomla plugin, so obviously it won't effect WordPress.

You can see the detials here, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2122

link|improve this answer
feedback
up vote -2 down vote

Looks like it was blocked, whatever it was.

link|improve this answer
Just freaked me out some... I had to see if I should worry about stuff like this. – Mike Wills Dec 12 '11 at 2:54
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.