Critical File Write Vulnerability in wget Package
Summary
ALPINE-CVE-2016-4971: GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. Affects wget versions < 1.17.1-r1. Fixed in 1.17.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wget package is a widely used command-line utility for downloading files from the web. It supports HTTP, HTTPS, and FTP protocols, allowing users to retrieve content from various sources. Despite its robust functionality, wget has been found vulnerable to a critical issue that allows remote servers to manipulate file writing, posing significant security risks.
Vulnerability Detail
GNU wget before version 1.18 is susceptible to a vulnerability that allows remote servers to redirect HTTP requests to malicious FTP resources. This flaw can lead to unauthorized file writing on the user's system, potentially compromising sensitive data and system integrity. The vulnerability is classified under CVE-2016-4971 and has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.17.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade wgetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using wget for downloading files from untrusted sources or disable FTP support if not needed. Additionally, consider using alternative tools that do not exhibit this vulnerability.
Conclusion
The wget package has a critical vulnerability that allows remote file writing through manipulated requests. Users are strongly advised to update to the latest patched version to mitigate risks. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for wget →
FAQ
CVE-2016-4971 is a security vulnerability in GNU wget that allows remote servers to write to arbitrary files by redirecting HTTP requests to crafted FTP resources.
You can check your wget version by running 'wget --version' in your terminal. If it is below 1.18, it is vulnerable.
The risks include unauthorized file writing, potential data breaches, and system compromise, which can lead to further exploitation.
Yes, tools like Vulert can monitor your applications for open-source vulnerabilities in real-time using a manifest file like package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for wget.
