0

I received about 50 messages today with the similar message:

WordPress Firewall has detected and blocked a potential attack!

Web Page: domain.com/index.php?option=com_simpledownload&controller=../../../../../../../../../../../../../../../proc/self/environ%00 Warning: URL may contain dangerous content! Offending IP: 211.147.221.42 [ Get IP location ] Offending Parameter: controller = ../../../../../../../../../../../../../../../proc/self/environ

This may be a "Directory Traversal Attack."

How much should I worry about these? It came from multiple IP addresses throughout the day.

  • Harmless. These type of requests are quite normal. And that "wordpress firewall" thing is probably useless... – onetrickpony Dec 12 '11 at 2:52
  • That is what I was thinking, but I had to ask. – Mike Wills Dec 12 '11 at 2:55
4

This is very common, it is a malicious query string most likely (99% time) done by a bot, I think option=com_simpledownload is actually a Joomla plugin, so obviously it won't effect WordPress.

You can see the detials here, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2122

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.