FTP PASV Mode IP Spoofing SSRF in GNU Wget

Compliance Impact

The vulnerability allows an attacker to perform server-side request forgery (SSRF) from the machine running Wget, potentially accessing internal network resources or localhost services. This unauthorized access to internal systems could lead to exposure or exfiltration of sensitive data.

Such unauthorized access and potential data exposure may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, if exploited, this vulnerability could lead to violations of these standards by enabling attackers to bypass network protections and access protected data or systems.

Useful 0 Not Useful 0

Executive Summary

The vulnerability in GNU Wget involves its FTP passive mode implementation where it does not validate the IP address provided by the FTP server's PASV response.

A malicious FTP server or an HTTP server redirecting to an FTP URL can exploit this by sending a spoofed PASV response with an arbitrary IP address and port.

This causes Wget to redirect its data connection to an attacker-controlled or arbitrary host, enabling server-side request forgery (SSRF).

As a result, the attacker can make Wget access internal network services or localhost resources that would otherwise be inaccessible.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to exploit Wget running on your machine to perform server-side request forgery (SSRF).

An attacker can redirect Wget's data connection to arbitrary IP addresses and ports, potentially accessing internal network services or localhost resources that are normally protected.

This could lead to unauthorized access to sensitive internal systems, data exposure, or further exploitation within your network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing whether GNU Wget accepts and connects to spoofed IP addresses provided in FTP PASV responses. One approach is to use a fake or controlled FTP server that returns a spoofed PASV response with an IP address different from the control connection's peer address.

If Wget connects to the spoofed IP address without error, it is vulnerable. If it rejects the spoofed response with an error message, it is patched.

A practical detection method involves running a test FTP server that sends a PASV response with a forged IP address and observing Wget's behavior.

Specific commands are not provided in the resources, but the concept involves:

• Setting up or using a test FTP server that returns a spoofed PASV response.
• Running Wget to connect to this FTP server.
• Observing whether Wget connects to the spoofed IP or rejects the connection.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update GNU Wget to the latest version that includes the fix for this vulnerability.

The fix ensures that Wget validates the IP address in the FTP PASV response against the control connection's peer address and rejects mismatched responses, preventing SSRF attacks.

Until the update can be applied, avoid using Wget to retrieve files from untrusted FTP servers or HTTP servers that redirect to FTP URLs.

Useful 0 Not Useful 0