Description
Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl. In the default emulated shell configuration, these command emulations perform real outbound HTTP requests to attacker-supplied destinations. Because no outbound request rate limiting was enforced, unauthenticated remote attackers could repeatedly invoke these commands to generate unbounded HTTP traffic toward arbitrary third-party targets, allowing the Cowrie honeypot to be abused as a denial-of-service amplification node and masking the attacker’s true source address behind the honeypot’s IP.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Cowrie Cowrie
Default version status: unaffected
0 to < 2.9.0affected
pkg:pypi/cowrieReferences
- https://github.com/advisories/GHSA-83jg-m2pm-4jxj ↗
- https://github.com/cowrie/cowrie/releases/tag/v2.9.0 ↗
- https://github.com/cowrie/cowrie/pull/2800 ↗
- https://github.com/cowrie/cowrie/issues/2622 ↗
- https://www.vulncheck.com/advisories/cowrie-unrestricted-wget-curl-emulation-enables-ssrf-based-ddos-amplification ↗