CVE-2024-38428

What it actually does

Mishandling of semicolons in the userinfo subcomponent of URIs in url.c causes data intended for credentials to be interpreted as part of the host component, enabling improper input validation that can redirect connections or leak information to attacker-controlled endpoints.

Why it matters to the business

Organizations relying on wget for automated downloads or mirroring face risk of sensitive credentials or data being sent to unintended hosts, potentially leading to data breaches or supply-chain compromise until systems are updated.

How an attack unfolds

An attacker crafts a malicious URI containing a semicolon in the userinfo portion and supplies it to wget; the parser incorrectly treats the subsequent data as the host, causing wget to connect to an attacker-chosen destination instead of the intended server and potentially transmit credentials or request content from a malicious location.

How to fix it

Upgrade GNU Wget to the fixed commit ed0c7c7e0e8f7298352646b2fd6e06a11e242ace or later; rebuild from the patched source if using a distribution package that has not yet incorporated the fix.

How to confirm the fix worked

Confirm the installed wget binary or source tree contains commit ed0c7c7e0e8f7298352646b2fd6e06a11e242ace; test by feeding a semicolon-containing userinfo URI and verifying the resolved host matches the intended authority component rather than the post-semicolon segment.

Typical attack path

1. Attacker constructs a URI with semicolon separating userinfo from a malicious host segment
2. Victim or automated process invokes wget with the crafted URI
3. url.c misparses the URI and resolves the attacker-controlled host
4. Connection is established to the unintended host, enabling data exfiltration or further exploitation

How to detect it

Review wget invocation logs and network connection records for URIs containing semicolons in the authority component; correlate process execution of wget with outbound connections to hosts that do not match the expected domain from the original URI.

What your security team should do

• Immediately update all wget installations to the patched commit
• Audit scripts and cron jobs that invoke wget with untrusted URIs
• Monitor network logs for unexpected host resolutions originating from wget processes
• Consider replacing wget with curl or other hardened clients where feasible until patches are widely deployed