CVE-2024-38428: Critical severity GNU Wget vulnerability
GNU Wget could allow a remote authenticated attacker to bypass security restrictions, caused by the mishandling of semicolons in the userinfo subcomponent of a URI. By sending a specially crafted request, an attacker could exploit this vulnerability to perform unauthorized actions.
Other sources
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
— Microsoft
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/wget 1.24.5to a version that resolves this vulnerability.Fixed in 10 - Upgrade
Upgrade
debian/wgetto a version that resolves this vulnerability.Fixed in 1.21.3-1+deb12u1 - Upgrade
Upgrade
debian/wgetto a version that resolves this vulnerability.Fixed in 1.24.5-2 - Upgrade
Upgrade
debian/wgetto a version that resolves this vulnerability.Fixed in 1.21.3-1+deb12u1Fixed in 1.25.0-2Fixed in 1.25.0-3 - Upgrade
Upgrade
GNU Wgetto a version that resolves this vulnerability.Fixed in 1.24.5Patch Upstream patch - Compensating control
Until patched, restrict exposure of GNU Wget instances that process remote, attacker-controlled URIs (e.g., limit which systems can invoke wget to trusted users/hosts and deny outbound access from those systems to untrusted destinations).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38428?
CVE-2024-38428 is classified as a moderate severity vulnerability due to its potential to allow unauthorized actions.
How do I fix CVE-2024-38428?
To fix CVE-2024-38428, upgrade to a patched version of Wget, specifically 1.24.5-2 or higher for Debian and 10 or higher for Red Hat.
Who is affected by CVE-2024-38428?
CVE-2024-38428 affects GNU Wget versions up to and including 1.24.5 on various platforms, including Debian and Red Hat.
Can CVE-2024-38428 be exploited remotely?
Yes, CVE-2024-38428 can be exploited by remote authenticated attackers through specially crafted requests.
What happens if CVE-2024-38428 is exploited?
If exploited, CVE-2024-38428 may allow attackers to bypass security restrictions and perform unauthorized actions.