Malicious activity?

Configuration
1

Hi

I’ve seen these in the logs. Is it a malicious attempt?

Logger: homeassistant.components.http.security_filter
Source: components/http/security_filter.py:54
Integration: HTTP (documentation, issues)
First occurred: 01:52:56 (1 occurrences)
Last logged: 01:52:56

Filtered a request with a potential harmful query string: ///remote/fgt_lang?lang=/…/…/…/…//////////dev/

And

Logger: homeassistant.components.http.security_filter
Source: components/http/security_filter.py:48
Integration: HTTP (documentation, issues)
First occurred: 31 January 2022, 13:31:56 (2 occurrences)
Last logged: 10:54:55

Filtered a potential harmful request to: /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh

2

Yes but home assistant blocked it.

3

Does HA usually block most attempts? Worth putting an OWASP filter in front too?

4

All, in my experience. When I had an open port.

5

Interesting. Is a security issue automatically logged or must I adjust my logger?

6

Automatically. No configuration required.

1 Like