Hardcoded Config Path in GNU wget Windows Builds Leads to Code Execution

Executive Summary

This is a local cross-user code execution vulnerability in GNU wget for Windows builds from eternallybored.org. It occurs due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users. An attacker can exploit this by creating a directory at the root of the C: drive and using the use_askpass directive to execute arbitrary code, potentially leading to local privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the C:\msys64 directory and verify if it is writable by unprivileged users. Inspect configuration files for the use_askpass directive pointing to this directory. Review system logs for unusual activity related to wget.exe or configuration file modifications.

Useful 0 Not Useful 0

Impact Analysis

On multi-user Windows systems, an attacker with limited access could escalate privileges by exploiting this flaw. They could execute arbitrary code with the permissions of the user running wget, potentially gaining control over the system or accessing sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily affects local system security by allowing arbitrary code execution through a hardcoded writable configuration path. It does not directly impact compliance with GDPR or HIPAA, as those standards focus on data protection, privacy, and security controls rather than local privilege escalation risks.

Useful 0 Not Useful 0

Mitigation Strategies

Remove write permissions for unprivileged users on the C:\msys64 directory. Delete or rename the directory if it is not required. Update wget to a patched version if available. Monitor for any unauthorized changes to configuration files or system directories.

Useful 0 Not Useful 0