I now get this error in my NodeJS server's logs:
[2021-11-13T14:43:45.107Z] URIError: Failed to decode param '/cgi-bin/%%32%65%%32%65/bin/sh'
at decodeURIComponent (<anonymous>)
at decode_param (~/node_modules/express/lib/router/layer.js:172:12)
at Layer.match (~/node_modules/express/lib/router/layer.js:123:27)
at matchLayer (~/node_modules/express/lib/router/index.js:574:18)
at next (~/node_modules/express/lib/router/index.js:220:15)
at expressInit (~/node_modules/express/lib/middleware/init.js:40:5)
at Layer.handle [as handle_request] (~/node_modules/express/lib/router/layer.js:95:5)
at trim_prefix (~/node_modules/express/lib/router/index.js:317:13)
at ~/node_modules/express/lib/router/index.js:284:7
at Function.process_params (~/node_modules/express/lib/router/index.js:335:12)
at next (~/node_modules/express/lib/router/index.js:275:10)
at query (~/node_modules/express/lib/middleware/query.js:45:5)
at Layer.handle [as handle_request] (~/node_modules/express/lib/router/layer.js:95:5)
at trim_prefix (~/node_modules/express/lib/router/index.js:317:13)
at ~/node_modules/express/lib/router/index.js:284:7
at Function.process_params (~/node_modules/express/lib/router/index.js:335:12)
It seems related to Apache's path traversal vulnerability. My server does not run Apache but I would still like to blacklist the IP address. This request does not print to the logs, and does not call my app's code in app.js.
How can I log the IP of the request?