After having a quick look at our apache access_log there are many http requests which seem unusual…what is the purpose of these and why do these happen so regularly?
No linking reports are running, or have been run recently - what else could be making the call? Looks like some kind of infinite or crashed loop. digging a little deeper, it is actually only happening on a single node in a cluster.In the squid log there is also the request for each matching apache request (we aren't caching _lib):
The file has been checked and I don't see any potential hack. Like I said, it also sits entirely outside of Matrix, so it doesn't even connect to the Matrix DB. There are many files in __lib and __fudge that are public in Matrix installs and any one of them could also be repeatably requested like this. Repeated requests to a public file does not make it vulnerable.
I agree it isn't a problem in anything being directly exploited from this file, it looks like the call originated probably from a form, something 'weird' happened and there was an infinite loop calling connectivity.php - it basically ground the server to a halt.
Unless you specifically require this page to be accessible externally, we would recommend blocking access to this file by default and allowing only specific addresses to connect to it.
The purpose of the file is documented in the file itself. The comment says "Page to test remote connectivity. Purpose: Check if a remote page exists (returns 200 OK)" It's really that simple.
If that url is accessed by anything, the script will run forever, and very quickly. I have tested this with machine names in place of 'host', but not a top level domain.
In terms of use within Matrix, the place that uses it is the "Auto-Test" feature of the backend interface for the URL attribute type, to check whether the URL that you have entered points to something that exists.
For what it's worth, it's relatively not-new; this feature has been there since 3.8. I'm not sure where within Matrix this is being used as an asset attribute, however for those with 3.14+ systems, it is used in the Comment asset's user preferences, for the "Rated Image/Blank Image" selection interface.