Did I get hacked?

[Marcia]

Logs are full of this, all from the same IP

206.148.224.238 - - [31/Dec/2001:03:50:17 -0500] "GET /cgi-bin/formmail.pl? recipient=[e-mail],[e-mail],[e-mail],davcoop6

[Key_Master]

Hack is a strong word but it looks as though your mail server was used to propagate spam e-mails without your consent. I know that doesn't sound better. I would look for a more secure formmail.pl script. This has the potential for getting you in trouble real fast.

Now I know why I've been banning Microsoft URL Control all this time.

[Brett_Tabke]

If you really have formmail.pl on your site, remove it asap. There is a whole in it and there is a scanning exploit running around. It auto attempts to send blindly. If it can one time, it comes back a thousand times and does it over and over to new people.

If you don't have formmail.pl on your system, you are a-ok.

[Marcia]

I'll notify AOL security right away. I changed the filename from .pl to .cgi - nothing's running on it right now anyway. Not from me.

[bobriggs]

I just ran the GET on my server (changing the receipient= to just my email address, and it did in fact send me an email.

If you're using FormMail, an extra piece of security for it. Change all methods on your site to POST, don't use get.

Original (from my copy)
# Determine the form's REQUEST_METHOD (GET or POST) and split the form #
# fields up into their name-value pairs. If the REQUEST_METHOD was #
# not GET or POST, send an error. #
if ($ENV{'REQUEST_METHOD'} eq 'GET') {
# Split the name-value pairs
@pairs = split(/&/, $ENV{'QUERY_STRING'});
}
elsif ($ENV{'REQUEST_METHOD'} eq 'POST') {
# Get the input
read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});

# Split the name-value pairs
@pairs = split(/&/, $buffer);
}
else {
&error('request_method');
}

I would change this to:
# Determine the form's REQUEST_METHOD (GET or POST) and split the form #
# fields up into their name-value pairs. If the REQUEST_METHOD was #
# not POST, send an error. #
if ($ENV{'REQUEST_METHOD'} eq 'POST') {
# Get the input
read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});

# Split the name-value pairs
@pairs = split(/&/, $buffer);
}
else {
&error('request_method');
}

[adding]
Although not completely foolproof, I would also change the 'recipient' field in the script and corresponding forms to some obscure term.

(edited by: bobriggs at 3:56 pm (gmt) on Jan. 1, 2002)

[Marcia]

Yes, formmail was there, I changed the file ext. and now I've deleted it altogether. It's all going to AOL so I've notified them about it.

[Brett_Tabke]

I couldn't figure out a way to trim that pack so we didn't have to side scroll (hope you don't mind).

Ya, formmail is pretty insecure. If you have to use it, rename it.

[toolman]

I think v. 1.9 is safe.

[Marcia]

Thanks, all. I pulled it altogether for the time being, will change and upload it again with another filename or use another script. More discussion on this going on, and toolman gave another remedy:

[webmasterworld.com...]