2

I've been looking at some httpd threads with strace and noticed a ton of locations that are incorrect:

access("/var/www/html/libraries/cms/database/database.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029> access("/var/www/html/libraries/joomla/database/database.php", F_OK) = 0 <0.000029>

access("/var/www/html/libraries/cms/database/query.php", F_OK) = -1 ENOENT (No such file or directory) <0.000028> access("/var/www/html/libraries/joomla/database/query.php", F_OK) = 0 <0.000029>

access("/var/www/html/libraries/cms/database/query/mysqli.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029> access("/var/www/html/libraries/joomla/database/query/mysqli.php", F_OK) = 0 <0.000033>

There are hundreds of these. Seems that these httpd threads look in the cms directory first but then correctly go to the joomla directory after. I think the "cms" directory is an old Joomla convention. Individually the impact is quite small but adding hundreds of these certainly adds up (timing wise). Anyone know what is going on here?

UPDATE:

Additional lines:

access("/var/www/html/libraries/cms/application/web.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>
access("/var/www/html/libraries/cms/application/base.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>
access("/var/www/html/libraries/cms/filter/input.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>
access("/var/www/html/libraries/cms/registry/registry.php", F_OK) = -1 ENOENT (No such file or directory) <0.000028>
access("/var/www/html/libraries/joomla/registry/registry.php", F_OK) = -1 ENOENT (No such file or directory) <0.000027>
access("/var/www/html/libraries/legacy/registry/registry.php", F_OK) = -1 ENOENT (No such file or directory) <0.000027>
access("/var/www/html/libraries/cms/uri/uri.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>
access("/var/www/html/libraries/cms/string/string.php", F_OK) = -1 ENOENT (No such file or directory) <0.010800>
access("/var/www/html/libraries/cms/event/dispatcher.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>

and the list goes on and on.

Improve this question
5
  • afaik there has never been a /libraries/cms/database directory. seems like a bug!? is there any way to tell where these calls come from? is it always the .../database/... directory?
    – fruppel
    Jul 28 '15 at 7:58
  • @fruppel I'm trying to understand myself where this is coming from, no luck so far. It's not always /database/ there are a bunch of other ones as well usually with 'cms' as the common incorrect path
    – Tom
    Jul 29 '15 at 4:41
  • interesting. can you post some more of these examples? does that happen on a new joomla installation? when does it happen?
    – fruppel
    Jul 29 '15 at 9:38
  • @fruppel updated post with more examples. I'm still on an older release 3.3.6, haven't tried on the latest. I've monitored many different httpd threads and this happens in most of them.
    – Tom
    Jul 30 '15 at 12:51
  • 3
    This is a wild guess, but someone may be trying to scan for known vulnerabilities using some automated scripts, but the files containing those vulnerabilities were renamed/moved in later versions hence the "no such file ..." error, but as I said it is a wild guess.
    – Mohd Abdul Mujib
    Jul 30 '15 at 14:04