wget / chromium: URL metadata and potential password leaks via extended filesystem attributes

guest · Jan 2, 2019

Open-source devs: Wget off your bloated festive behinds and patch this user cred-blabbing bug
New year, new security fails, new CVE
January 2, 2018
https://www.theregister.co.uk/2019/01/02/wget_bug_fix/

The popular utility retrieves internet-hosted HTTP/HTTPS and FTP/FTPS content and some years ago began storing extended attributes on disk as URIs.

On Christmas Day, security researcher Gynvael Coldwind (@voltagex) noted on Twitter that the stored attributes can include user credentials [...]
Though only stored locally, user IDs and passwords weren't protected, and as Hanno Böck pointed out on the OSS-Sec mailing list, URLs can even contain "secret tokens" used for external services like file hosting.

The bug has been designated CVE-2018-20483 and could be present in other systems as noted by the Mitre entry. "This also applies to Referer information in the user.xdg.referrer.url metadata attribute.
Böck said the same behaviour has been reported to the Chrome team and is awaiting a fix.
Click to expand...

Wget dev Tim Rühsen wrote that the utility stopped using xattrs by default in the newly issued version 1.20.1
Click to expand...

Log in or Sign up

wget / chromium: URL metadata and potential password leaks via extended filesystem attributes

guest Guest

Log in or Sign up

wget / chromium: URL metadata and potential password leaks via extended filesystem attributes

guest Guest

Useful Searches