CVE-2025-60876
📋 TL;DR
BusyBox wget versions through 1.3.7 improperly accept raw CR/LF and C0 control characters in HTTP request targets, allowing attackers to split request lines and inject malicious headers. This vulnerability affects any system using vulnerable BusyBox wget to fetch URLs from untrusted sources. The issue stems from insufficient input validation in HTTP request parsing.
💻 Affected Systems
- BusyBox wget
📦 What is this software?
Busybox by Busybox
⚠️ Risk & Real-World Impact
Worst Case
Full HTTP request smuggling leading to server-side request forgery (SSRF), credential theft via injected headers, or redirection to malicious sites when wget interacts with attacker-controlled URLs.
Likely Case
HTTP header injection enabling limited request manipulation, potentially causing wget to fetch unintended resources or leak information via injected headers.
If Mitigated
Minimal impact if wget only accesses trusted URLs with proper input validation and network segmentation.
🎯 Exploit Status
Proof-of-concept available in mailing list attachments; exploitation requires wget to process a malicious URL, which can be delivered via phishing, malicious websites, or compromised services.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: BusyBox 1.3.8 or later
Vendor Advisory: https://lists.busybox.net/pipermail/busybox/
Restart Required: No
Instructions:
1. Update BusyBox to version 1.3.8 or later. 2. For embedded systems: rebuild firmware with patched BusyBox or apply vendor updates. 3. Verify wget no longer accepts raw CR/LF/space in request targets.
🔧 Temporary Workarounds
Input validation wrapper
linuxCreate a wrapper script that validates URLs before passing to wget, rejecting URLs with control characters.
#!/bin/bash
# Validate URL contains no raw CR/LF/space
if echo "$1" | grep -q $'[\r\n\x00-\x1F\x7F]'; then
echo "Invalid URL"
exit 1
fi
busybox wget "$1"
Use alternative download tool
linuxReplace wget with curl or another download utility that properly validates HTTP requests.
apt-get install curl
yum install curl
apk add curl
🧯 If You Can't Patch
- Restrict wget to only fetch from trusted, whitelisted domains using firewall rules or proxy configurations.
- Monitor wget usage for unusual patterns and implement strict input validation in any scripts calling wget.
🔍 How to Verify
Check if Vulnerable:
Test with: echo -e 'GET /test\r\nInjected: header HTTP/1.1\r\nHost: example.com' | nc -l 8080 & busybox wget http://localhost:8080/test -O /dev/null; check if server receives injected header.Check Version:
busybox | grep wget && busybox wget --version 2>&1 | head -1Verify Fix Applied:
After update, repeat vulnerable test; wget should reject the request or not pass injected headers.📡 Detection & Monitoring
Log Indicators:
- Unusual wget processes fetching unexpected URLs
- HTTP requests with raw CR/LF characters in logs
- Failed wget attempts with malformed URLs
Network Indicators:
- HTTP requests containing %0D, %0A, or other control characters in paths
- Unexpected HTTP headers in wget-initiated requests
SIEM Query:
process.name:"wget" AND (url.path:*\r* OR url.path:*\n* OR url.path:*%0D* OR url.path:*%0A*)