Attempted HTTP Attacks on the Zurvur

November 18, 2025

Since setting up the Zurvur and registering its domain with Cloudflare, I have had numerous different HTTP requests that attempt to exploit certain vulnerabilities with web servers.

They seem to come from common IP addresses; that is, a small number of bots have been crafted to scan the entire IPv4 address space (or just recently registered domains for major providers), looking for openings for them to exploit. Most of them come from the same 20-hour initial period of the domain being live.

Here is an incomplete list of some of the gems (actual .log entries for Zurvur).

H2 Database Console RCE

Gives developers an endpoint for access to the lightweight Java SQL database that is preloaded with Spring Boot. Shouldn't be accessible in prod, but often forgotten about when deploying, allowing for malicious SQL statement execution and therefore RCE.

Xdebug Remote Debugging RCE

Another dev solution that is often forgotten about and deployed to prod. Opens a PHP debugging session through the attacker's IP allowing RCE through the debugger on the server. One thing to notice is that this request returned 200: successfully returned the landing page despite the ignored query that starts the debug session.

OpenWrt LuCI path traversal + session token injection

This HTTP request attempts to exploit a vulnerability in LuCI (OpenWrt) routers via privilege escalation. This doesn't work in the vast majority of cases, and would only be dangerous if you exposed the admin console for your router to WAN for some reason.

Spring Cloud Gateway Actuator RCE - CVE-2022-22947

This is an attempt to see if Spring Boot is being used and if Cloud Gateway is enabled. Allows RCE via maliciously crafted routing rules added via a POST request.

Laravel Ignition RCE - CVE-2021-3129

A Laravel exploit which allows RCE via crafting a malicious "error solution" which is then run by the server. Usually only enabled in dev environments but occasionally is left enabled in prod.

PHPUnit eval-stdin.php RCE - CVE-2017-9841

Another tool intended only for developer use, literally executes PHP code with no safeguards. Meant for unittesting, but if deployed to prod, hands hackers the keys to your system.

Microsoft Exchange Autodiscover - ProxyLogon/ProxyShell exploits

A Microsoft Exchange Server path sanitization bug allows for carefully crafted HTTP headers which, through achain of attacks, allows full access to the server via privilege escalation.

Apache Solr Admin API RCE - Multiple CVEs

Multiple vulnerabilities exist in Apache Solr's Admin API. The /admin/info/system endpoint exposes version and configuration details, enabling attackers to select targeted exploits. Combined with vulnerabilities like CVE-2019-17558 (Velocity template injection), this recon step often precedes RCE attempts.

AWS config file disclosure

If the Zurvur were an AWS (Amazon Web Services) instance, and had its config file mistakenly deployed to the web root, this request could have exposed API keys allowing attackers access to the AWS host account, allowing them do to malicious things such as incurring charges for spinning up more infrastructure to mine cryptocurrency.

The Pattern

Most of these requests return 404 (File Not Found) or 400 (Bad Request). This is the 2011 Dell laptop doing its job, rejecting attempts to request nonexistent files and correctly handling any path traversal syntax trickery. It has none of the required software for these vulnerabilities installed, and serves only static .html files.

Despite its simplicity, the nginx access.log has provided significant insight into modern attack vectors that IP crawlers use to gain root access to web servers all over the Internet. Hopefully this page serves as a reminder to ensure your configuration for your web server and all sensitive files are NOT VISIBLE FROM THE WEB ROOT.