CVE-2025-34469
📋 TL;DR
Cowrie honeypot versions before 2.9.0 contain a server-side request forgery vulnerability in the emulated wget and curl commands. Unauthenticated attackers can abuse these emulations to generate unlimited outbound HTTP requests to arbitrary targets, turning the honeypot into a denial-of-service amplification node while hiding their true source IP. This affects all Cowrie deployments using default emulated shell configurations.
💻 Affected Systems
- Cowrie SSH/Telnet Honeypot
📦 What is this software?
Cowrie by Cowrie
⚠️ Risk & Real-World Impact
Worst Case
Cowrie honeypot becomes a high-volume DDoS amplification node generating unlimited HTTP traffic toward third-party targets, potentially causing significant service disruption while completely masking attacker origin.
Likely Case
Honeypot used for DDoS amplification attacks against external targets, generating substantial unwanted traffic and potentially causing collateral damage to the honeypot's network reputation.
If Mitigated
Limited impact with proper network segmentation and egress filtering, though honeypot could still be abused for limited SSRF attacks.
🎯 Exploit Status
Exploitation requires only SSH/Telnet access to Cowrie honeypot; no authentication needed. Attackers can repeatedly invoke wget/curl commands with arbitrary URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.0
Vendor Advisory: https://github.com/advisories/GHSA-83jg-m2pm-4jxj
Restart Required: Yes
Instructions:
1. Backup current Cowrie configuration. 2. Stop Cowrie service. 3. Update to version 2.9.0 via git pull or fresh installation. 4. Restart Cowrie service. 5. Verify version with 'cowrie --version'.
🔧 Temporary Workarounds
Disable wget and curl emulations
linuxRemove or disable the vulnerable command emulations in Cowrie configuration
Edit cowrie.cfg: set [honeypot] enable_wget = false
Edit cowrie.cfg: set [honeypot] enable_curl = false
Implement outbound rate limiting
linuxAdd network-level rate limiting for outbound HTTP requests from Cowrie host
iptables -A OUTPUT -p tcp --dport 80 -m limit --limit 10/minute -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m limit --limit 10/minute -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Network segment Cowrie honeypot with strict egress filtering to limit outbound HTTP traffic
- Implement application-level request rate limiting for wget/curl emulations in Cowrie configuration
🔍 How to Verify
Check if Vulnerable:
Check Cowrie version: if version < 2.9.0 and wget/curl emulations are enabled in cowrie.cfg, system is vulnerable.Check Version:
cowrie --versionVerify Fix Applied:
After patching, verify version is 2.9.0+ and test that wget/curl commands no longer perform unlimited outbound requests.📡 Detection & Monitoring
Log Indicators:
- Unusual volume of wget or curl command executions in Cowrie logs
- Multiple outbound HTTP requests to diverse external domains from single session
Network Indicators:
- High volume of outbound HTTP traffic from Cowrie host to multiple external IPs
- Unusual HTTP request patterns from honeypot IP
SIEM Query:
source="cowrie.log" AND ("wget" OR "curl") | stats count by src_ip, dest_ip🔗 References
- https://github.com/advisories/GHSA-83jg-m2pm-4jxj
- https://github.com/cowrie/cowrie/issues/2622
- https://github.com/cowrie/cowrie/pull/2800
- https://github.com/cowrie/cowrie/releases/tag/v2.9.0
- https://www.vulncheck.com/advisories/cowrie-unrestricted-wget-curl-emulation-enables-ssrf-based-ddos-amplification
- https://github.com/advisories/GHSA-83jg-m2pm-4jxj
