url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
The vulnerability results from incorrect interpretation (CWE-436 — Interpretation Conflict) of URI syntax in the url.c file. When a URL contains a semicolon in the userinfo section (the part before the '@' sign, containing authentication data), Wget incorrectly classifies the data fragment as belonging to the host subcomponent. This results in a discrepancy between what the user or script intends to pass as login credentials and which host the connection is actually established with.
An attacker can craft a malicious URL to cause Wget to establish a connection with an unintended host, which may lead to disclosure of sensitive data (e.g., authentication credentials transmitted to an attacker-controlled server) or unauthorized modification of downloaded resources.
Apply patches available from the vendor according to the references. The fix was introduced in the project repository (commit ed0c7c7e0e8f7298352646b2fd6e06a11e242ace in the GNU Wget repository on Savannah). Update to a version containing the indicated patch is recommended.
GNU Wget in versions up to and including 1.24.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NGnu Wget
APPGnu≤ 1.24.5
Related vulnerabilities
Buffer overflow w GNU Wget — RCE lub DoS przez sieć
GNU Wget: heap buffer underread w przetwarzaniu URL w plikach Metalink
set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url m...
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked i...
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When...