Hello, any news about a potential CVE fix ?

What was done in curl, could it be done for wget as well ?

Looking at the curl patch, it seems that it restricts all Authorization headers, even manually added ones, unless the option is set. That seems like the right way to go to me.

https://github.com/curl/curl/commit/af32cd3859336ab.patch

Is there any news on this issue?

A CVE seems to have been assigned :

https://nvd.nist.gov/vuln/detail/CVE-2021-31879

https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html

I agree with Tim here that this is not a security issue.

Wget provides an option to correctly use the Authorization header. If the user chooses to otherwise coerce Wget into doing something different, we should not stop them from doing so.

Using `--header=Authorization: ds` means that the user is explicitly opting to send the header everytime rather than only to a specific domain.

On your request I'm making this issue public.

I do not really think header manipulation necessarily involves expert level knowledge with security in mind.

I do not think that the current behaviour is likely to be abused with malicious intent.
However, what can be considered worrying is the case of "cloud services", where you authenticate to Server A, which redirects you to cloud server B with a signed token. Even if both A and B are considered safe, there is still no reason for B, possibly hosted by some random cloud service on the other side of the world, to receive credentials meant for A. Even though B is probably trusted, it still accidentally receives credentials not meant to be sent there.


curl resolved this by defaulting to `Authorization` not being forwarded unless CURLOPT_UNRESTRICTED_AUTH flag is set (https://curl.haxx.se/docs/CVE-2018-1000007.html)

If the behavior is not going to be changed because undefined in RFC, then a warning in the documentation & man page could be written, to ensure that people using an `Authorization` header are aware that the server may return a redirect.

wget is vulnerable to
a flaw similar to curl's CVE-2018-1000007
(https://access.redhat.com/security/cve/cve-2018-1000007)

Here's the description :
-> if you use wget with the regular --user & --password leading to a Basic authentication, and that the server returns a redirect, wget will correctly remove the `Authorization` header before following the redirect query
-> However, if you add the basic authentication manually in the header (e.g.: `Authorization: Basic <credentials>`), wget will NOT clean that up before the redirect. Which means that 2nd server will receive unexpected credentials.
Filling up the `Authorization` header is likely to happen when you use wget in a script, or if you want to avoid the first request created by the `--user` option.

The leak could be an issue in certain situation (e.g.: more and more services being in "the cloud", redirect to other servers after authentication is, I believe, not uncommon).

No CVE has been assigned yet, I was first hoping to get you feedback & plan.

This was originally reported by Ryan Blakley of Red Hat.

Best regards,

Cedric