GNU wget up to 1.24.x HTTP Shorthand Format server-side request forgery

Summaryinfo

A vulnerability has been found in GNU wget up to 1.24.x and classified as critical. The impacted element is an unknown function of the component HTTP Shorthand Format Handler. This manipulation causes server-side request forgery. This vulnerability is tracked as CVE-2024-10524. The attack is possible to be carried out remotely. Moreover, an exploit is present. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in GNU wget up to 1.24.x. It has been declared as critical. Affected by this vulnerability is an unknown part of the component HTTP Shorthand Format Handler. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

It is possible to read the advisory at jfrog.com. This vulnerability is known as CVE-2024-10524 since 10/30/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 211900 (CBL Mariner 2.0 Security Update: wget (CVE-2024-10524)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.25.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211900). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• GNU

Name

• wget

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion