Hacking attempt, process running under 'apache' user

Question

Our system blocked an hacking attempt coming from a local process running under the apache system user.

Process not allowed.

{
"USER": "apache 16",
"PID": "617",
"%CPU": "0.0",
"%MEM": "0.0 80",
"VSZ": "556 3",
"RSS": "904",
"TTY": "?",
"STAT": "S",
"TIME": "0:00",
"COMMAND": "curl -v -u -d yyyy http://127.0.0.1:xxxx/"
}

How could the apache user run curl?

From the /etc/passwd file:

apache:x:48:48:Apache:/var/www:/sbin/nologin

Shouldn't this block apache from running any command?

We are running CentOS release 6.7 (Final) with SELinux enforced.

Answer 1

No, it just means that the user cannot log in and run a shell, he can execute commands though.

Just try the following, as root:

mkdir test
chown apache:apache test
sudo -u apache touch test/file

And now the user apache has used the command touch.

It is the very idea of a system user to execute commands/run progams/deamons etc. with their specific ID and the permissions following thereof.