Grey Noise | Observed In The Wild: HTTP PUT Anomalies Explained
Summary: GreyNoise sensors recorded an anomalous uptick in HTTP PUT requests between January 22 and January 24, 2023, with most occurring from January 15 to January 26 and 2,927 payloads carrying randomly generated paths ending in .txt or .jsp. The request bodies held random strings, including one inside a JSP comment field, which GreyNoise assesses as an attempt to plant a unique identifier and test whether the server accepts uploads, serves the file back, and renders the JSP page.
What you should know: The same traffic included FortiOS authentication bypass paths under /api/v2 and FxCodeShell.jsp webshell paths, and it led GreyNoise to a new signature for CVE-2017-12635 - attackers are using known vulnerabilities to fingerprint exposed services, so an unexplained PUT in your logs may be someone mapping what you run.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2017-12635
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026