Medium severity · published Nov 19, 2024
CVE-2024-10524
GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs
6.5
CVSS
1.1%
EPSS
No
On KEV
Description
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
wget · gnu
before 1.25.0 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10524
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10524
git.savannah.gnu.org
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778
jfrog.com
https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/
seclists.org
https://seclists.org/oss-sec/2024/q4/107
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/11/18/6
security.netapp.com
https://security.netapp.com/advisory/ntap-20250321-0007/
More from wget
9.8
CVE-2019-5953
Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors
9.1
CVE-2024-38428
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the…
8.8
CVE-2017-13090
The retr.c:fd_read_body() function is called when processing OK responses
8.8
CVE-2017-13089
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects
8.8
CVE-2016-4971
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource