CVE-2014-4877
GNU Wget < 1.16 - Absolute Path Traversal via FTP LIST Response Symlink Handling
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-4877.
PoCs published by hdm, including Metasploit module auxiliary/server/wget_symlink_file_write.
AI-analyzed exploit summary This Metasploit module exploits a vulnerability in GNU Wget (CVE-2014-4877) by setting up a malicious FTP server that uses symlinks to write arbitrary files to the target filesystem. It leverages Wget's recursive mode to trick the client into writing data to unintended locations.
Description
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Exploits (1)
This Metasploit module exploits a vulnerability in GNU Wget (CVE-2014-4877) by setting up a malicious FTP server that uses symlinks to write arbitrary files to the target filesystem. It leverages Wget's recursive mode to trick the client into writing data to unintended locations.