CVE-2024-38428
📋 TL;DR
GNU Wget through version 1.24.5 incorrectly parses semicolons in the userinfo portion of URIs, potentially causing userinfo data to be misinterpreted as part of the host component. This could lead to credential exposure, authentication bypass, or unintended connections to malicious hosts. Anyone using affected Wget versions to fetch URLs containing semicolons in userinfo fields is vulnerable.
💻 Affected Systems
- GNU Wget
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept credentials, redirect connections to malicious servers, or bypass authentication mechanisms by crafting URIs with semicolons in userinfo fields.
Likely Case
Credential leakage when Wget processes URIs containing semicolons in authentication data, potentially exposing passwords or tokens to unintended hosts.
If Mitigated
Limited impact if Wget is only used with trusted URLs or in environments where URI parsing is validated elsewhere.
🎯 Exploit Status
Exploitation requires Wget to process a malicious URI, which could occur through scripts, automated tools, or user interaction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.24.6 or later
Vendor Advisory: https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
Restart Required: No
Instructions:
1. Download latest Wget from https://ftp.gnu.org/gnu/wget/ 2. Compile and install following standard build procedures 3. Verify installation with 'wget --version'
🔧 Temporary Workarounds
Avoid semicolons in URIs
allManually validate and sanitize URIs before passing to Wget, ensuring no semicolons exist in userinfo fields.
Use alternative download tools
allTemporarily replace Wget with curl or other download utilities until patched.
# Example: Use curl instead of wget
curl -O https://example.com/file
🧯 If You Can't Patch
- Restrict Wget usage to trusted, internal URLs only
- Implement network monitoring for unexpected connections from Wget processes
🔍 How to Verify
Check if Vulnerable:
Run 'wget --version' and check if version is 1.24.5 or earlierCheck Version:
wget --version | head -1Verify Fix Applied:
After patching, confirm version is 1.24.6 or later with 'wget --version'📡 Detection & Monitoring
Log Indicators:
- Wget connections to unexpected hosts
- Failed authentication attempts with unusual URIs
Network Indicators:
- Outbound connections from Wget to unknown IPs
- HTTP requests with malformed Authorization headers
SIEM Query:
process.name:"wget" AND (destination.ip NOT IN [trusted_ips] OR url.query CONTAINS ";")🔗 References
- https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
- https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
- https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
- https://lists.debian.org/debian-lts-announce/2025/04/msg00029.html
- https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
- https://security.netapp.com/advisory/ntap-20241115-0005/
