CVE-2014-4877

What it actually does

Absolute path traversal via crafted FTP LIST responses containing duplicate filenames where one is marked as a symlink, allowing writes to arbitrary filesystem locations when recursive download is enabled.

Why it matters to the business

Attackers can place and execute malicious code on systems that automatically mirror content from untrusted FTP servers, leading to full host compromise and potential supply-chain poisoning of downloaded artifacts.

How an attack unfolds

A malicious FTP server returns a LIST response with two entries for the same filename; one entry declares the file as a symlink pointing outside the download tree. Wget follows the symlink during recursion and writes attacker-controlled content to arbitrary paths, resulting in code execution.

How to fix it

Upgrade GNU Wget to version 1.16 or later. Disable recursive downloads from untrusted sources until patched. Consider replacing wget with curl or aria2 where recursion from FTP is not required.

How to confirm the fix worked

Run 'wget --version' and confirm 1.16 or newer; test recursive FTP fetches against a controlled server that emits symlink entries and verify writes remain confined to the destination directory.

Typical attack path

1. Attacker sets up malicious FTP server
2. Victim runs wget with recursive mode against the server
3. Server returns specially crafted LIST response
4. Wget follows symlink and writes payload to arbitrary location
5. Payload is executed via scheduled task, cron, or user invocation

How to detect it

Search process execution logs and command histories for wget invocations with -r or --recursive flags against external FTP hosts; examine downloaded directory trees for unexpected symlinks or files written outside the intended destination.

What your security team should do

• Immediately inventory all systems using wget < 1.16 and schedule upgrades
• Block or sandbox automated wget recursion jobs that contact external FTP servers
• Add wget version checks to configuration management and CI pipelines