CRLF Injection Vulnerability in Wget: Remote Header Injection Risk
Summary
ALPINE-CVE-2017-6508: CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL. Affects wget versions < 1.19.1-r1. Fixed in 1.19.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wget is a widely used command-line utility for downloading files from the web. It supports HTTP, HTTPS, and FTP protocols, making it a versatile tool for retrieving content. Wget is known for its ability to handle recursive downloads and its robustness in handling network interruptions. However, it has been identified to have a CRLF injection vulnerability that can be exploited by attackers to inject arbitrary HTTP headers, potentially compromising the integrity of web communications.
Vulnerability Detail
The vulnerability, identified as CVE-2017-6508, originates from the url_parse function in Wget's url.c file. It allows remote attackers to inject arbitrary HTTP headers by exploiting CRLF sequences in the host subcomponent of a URL. This could lead to various attacks, including HTTP response splitting, which can manipulate the response sent to users, potentially leading to session hijacking or other malicious activities. The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.19.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade wgetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Wget to download files from untrusted sources or URLs that may contain CRLF sequences. This can help mitigate the risk until the package is updated.
Conclusion
The CRLF injection vulnerability in Wget poses a significant risk to users and applications relying on this utility for file downloads. It is crucial to update to the patched version to safeguard against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for wget →
FAQ
A CRLF injection vulnerability allows an attacker to inject arbitrary HTTP headers into a response by exploiting CRLF sequences in a URL, potentially leading to various attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploiting this vulnerability can lead to HTTP response splitting, session hijacking, and other malicious activities that compromise user data and application integrity.
Yes, the patched version of Wget is 1.19.1-r1 for Alpine Linux. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, avoid using Wget for downloading files from untrusted sources to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for wget.
