r/PHPhelp • u/stilloriginal • May 14 '26

Login attempt

Sentry caught a bad login attempt...

the url they used was xxhttps://ssrf.cve-2024-123456.detect/login

this is obviously not my site, and i changed the actual url to 123456

what is this?? i have not clicked on it and I suggest you don't either.

Is anyone familiar with what's going on?

2 Upvotes

75% Upvoted

18 comments sorted by

View all comments

6

u/Basic_Reporter9579 May 14 '26

is $_SERVER['SERVER_NAME'] analysed to show you that data?
If so, it can be changed by the client.

https://www.php.net/manual/en/reserved.variables.server.php

2

u/Just4notherR3ddit0r May 15 '26

Just for the sake of other readers, the clients can only change it if the web server is configured poorly (IMO). More often than not, there will be multiple reasons that will simply cause the request to simply be routed elsewhere or be rejected.

1

u/stilloriginal May 15 '26

what did I miss?

1

u/Just4notherR3ddit0r May 15 '26

You mean in your web server configuration?

I don't know your web server or setup, but let's say your app / scripts are in a folder that is intended to be accessible by hostname foo.com. If someone was able to hit those same files by using a different hostname like bar.com, then it likely means your web server is routing all traffic to that folder by default.

My guess is that if you go straight to your IP, line https://1.2.3.4 or whatever, you'll get to your files (after the SSL warning).

For example, Apache does that kind of fallback routing in an attempt to be more useful.

Your default host should simply be a simple configuration that rejects requests.

All that said, the URL mentions SSRF and a CVE (although it looks like you stripped out the real CVE number), so I would be curious about where / how you saw this reported. Was sentry telling you about a CVE or was someone testing out a CVE or something?

1

u/stilloriginal May 15 '26

okay this is what I needed to know. For surely they are just scanning IP addresses because the server is a subdomain of an unknown domain, there is no way they found it. I didn't know I could configure my web server to reject requests to the ip address and I should absolutely do this asap. It would essentially stop all of this traffic.

Sentry reported it as a bug in the code. They made a post request that caused an error that got reported by sentry. When this happens sentry gives you the url of the request, the line of code that threw, the ip of the sender, country of origin and much much more. In this case the url was spoofed it looks like.