AWS Abuse Report

[macone]

Hi,
I received Abuse Report from AWS. They demand an answer from me. Is there cause for concern? Could the system have been compromised? I am running Cloudron instance from AWS market. Thank you.

* Log Extract:
<<<
Incident time (GMT +0000): 2023-08-15 19:34:26

Url: [hf###ry.org/xmlrpc.php]
Remote connection: [xxx.xxx.xxx.xxx:42668]
Headers: [array (
'Host' => 'hf###ry.org',
'User-Agent' => 'Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/95.0',
'Content-Length' => '479',
'Content-Type' => 'application/x-www-form-urlencoded',
'Accept-Encoding' => 'gzip',
'Connection' => 'close',
)]
Post data: [Array
(
[<?xml_version] => "1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data><value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member><member><name>params</name><value><array><data><value><array><data><value><string>admin</string></value><value><string>google</string></value></data></array></value></data></array></value></member></struct></value></data></array></value></param></params></methodCall>
)
]
>>>

* Comments:
<<<
BitNinja presents a CAPTCHA to the visitor, if it is resolved correctly (either automatically via our Browser Integrity Check, or manually), the IP address will be removed from the greylist, if ignored, it will generate a security incident, and the connection will be terminated.
>>>

[girish]

@macone I can't quite make out frm the report what is going on. Is it saying that Cloudron made an outbound request to some location ? If so , what is the app at hf###ry.org ? Is that a WordPress developer edition ? Can you check if that app has been compromised? Usually there are suspicious things in wp-config.php or wp-include.php

[macone]

hf###ry.org is not our app and is not hosted in our network.

[nebulon]

The report mentions some BitNinja, could this be generated from that if you have BitNinja installed in your WordPress instance?

[macone]

No we don't use BitNinja, report was generated and sent by AWS

[nebulon]

Then I guess you have to consult them for more explanation.

[macone]

My opinion is that this is an xml-rpc attack on our Wordpress site from hf###ry.org. Does it make sense?

[nebulon]

yes that is also how I would have read it.

[girish]

I am still confused why they demand an answer from you, if your website is getting abused...