bugGNU Wget - Bugs: bug #61492, --no-verbose leaks information...

 
 

bug #61492: --no-verbose leaks information about HTTP password to stdout

Submitter:  Per Lundberg <perlun>
Submitted:  Tue 16 Nov 2021 01:29:02 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  trunk Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  No
Work Required:  None Patch Included:  No
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 01 Dec 2021 10:40:51 PM UTC, comment #1: 

Fixed in trunk.

Thanks!

Darshit Shah <darnir>
Group administrator
Tue 16 Nov 2021 01:29:02 PM UTC, original submission:  

Hi,

We discovered locally that wget (version 1.19.4 running on Ubuntu 18.04 and 1.21 running on Debian GNU/Linux bullseye) has an information leak if being used with the --no-verbose flag. Here's an example of its output when executed this way:

some-server:/some/path$ wget https://foo:bar@some-host.acme.com --no-verbose
2021-11-16 10:02:09 URL:https://foo:bar@some-host.acme.com/ [0/0] -> "index.html.1" [1]

As can be seen above, the "foo:bar" user:password is incorrectly printed to the standard output when this flag is being used.

Compare to the normal output when the --no-verbose flag is not used. In this case, the password is properly masked and replaced with password in the output:

some-server:/some/path$ wget https://foo:bar@some-host.acme.com
--2021-11-16 10:02:14--  https://foo:*password*@some-host.acme.com/
Resolving some-host.acme.com (some-host.acme.com)... 10.11.12.13
Connecting to some-host.acme.com (some-host.acme.com)|10.11.12.13|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 0 [text/html]
Saving to: ‘index.html.2’

index.html.2                                                         [ <=>                                                                                                                                                     ]       0  --.-KB/s    in 0s     

2021-11-16 10:02:14 (0,00 B/s) - ‘index.html.2’ saved [0/0]

Thanks in advance.

Best regards
Per Lundberg

Per Lundberg <perlun>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by rockdaboot (Updated the item)
  • -email is unavailable- added by perlun (Submitted the item)
  •  

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-12-01 darnir StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2021-11-16 rockdaboot StatusNone Confirmed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code