github-repos/wget
1
0
Fork 0
mirror of https://github.com/mirror/wget.git synced 2026-08-22 19:03:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2014-4877: Arbitrary Symlink Access

Browse Source 
Wget was susceptible to a symlink attack which could create arbitrary
files, directories or symbolic links and set their permissions when
retrieving a directory recursively through FTP. This commit changes the
default settings in Wget such that Wget no longer creates local symbolic
links, but rather traverses them and retrieves the pointed-to file in
such a retrieval.

The old behaviour can be attained by passing the --retr-symlinks=no
option to the Wget invokation command.
This commit is contained in:
Darshit Shah
2014-09-08 00:41:17 +05:30
committed by Giuseppe Scrivano
parent c986ea790c
commit 18b0979357
4 changed files with 38 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
doc/ChangeLog
View File

@@ -1,3 +1,9 @@
2014-09-08 Darshit Shah <darnir@gmail.com>
* wget.texi (symbolic links): Update documentation of retr-symlinks to
reflect the new default. Add warning about potential security issues with
--retr-symlinks=yes.
2014-10-16 Tim Ruehsen <tim.ruehsen@gmx.de>
* wget.texi (Download Options): update --secure-protocol description

21
doc/wget.texi
View File

@@ -1883,17 +1883,18 @@ Preserve remote file permissions instead of permissions set by umask.
@cindex symbolic links, retrieving
@item --retr-symlinks
Usually, when retrieving @sc{ftp} directories recursively and a symbolic
link is encountered, the linked-to file is not downloaded. Instead, a
matching symbolic link is created on the local filesystem. The
pointed-to file will not be downloaded unless this recursive retrieval
would have encountered it separately and downloaded it anyway.
By default, when retrieving @sc{ftp} directories recursively and a symbolic link
is encountered, the symbolic link is traversed and the pointed-to files are
retrieved. Currently, Wget does not traverse symbolic links to directories to
download them recursively, though this feature may be added in the future.
When @samp{--retr-symlinks} is specified, however, symbolic links are
traversed and the pointed-to files are retrieved. At this time, this
option does not cause Wget to traverse symlinks to directories and
recurse through them, but in the future it should be enhanced to do
this.
When @samp{--retr-symlinks=no} is specified, the linked-to file is not
downloaded. Instead, a matching symbolic link is created on the local
filesystem. The pointed-to file will not be retrieved unless this recursive
retrieval would have encountered it separately and downloaded it anyway. This
option poses a security risk where a malicious FTP Server may cause Wget to
write to files outside of the intended directories through a specially crafted
@sc{.listing} file.
Note that when retrieving a file (not a directory) because it was
specified on the command-line, rather than because it was recursed to,