wget prior to 1.16 allows for a web server to write arbitrary files on the client side

by
Anonymous Coward
in security on (#2TS1)
Here's a concern for most of us. Be aware that the popular program wget, in versions prior to 1.16, allows for a FTP server to write arbitrary files on the client side. Wget is commonly used in shell scripts to get files or web pages from servers for further processing locally. Wget has many other uses as well, and is an important part of much command line sorcery.

A Metasploit module is available for testing:

https://github.com/rapid7/metasploit-framework/pull/4088

the disclosure is here:

https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access

Redhat's bug is here:

https://bugzilla.redhat.com/show_bug.cgi?id=1139181

Re: This one is really serious (Score: 4, Informative)

by seriously@pipedot.org on 2014-10-29 15:08 (#2TSB)

Note that it applies only to using wget with both an FTP connexion and recursive flags, which significantly reduces it's potential.

Not to say that it is not a serious one, it is, but it's not as bad as wget on a http url for a single file (which is something I do daily). Now, that would be really messy.
Post Comment
Subject
Comment
Captcha
What is fifty nine thousand four hundred and fifty one as digits?