https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 13:02:18 +0000 https://cve.radiocsirt.org/vuln/cve-2025-34469 <p><strong>Affected:</strong> Cowrie</p> <p>Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl. In the default emulated shell configuration, these command emulations perform real outbound HTTP requests to attacker-supplied destinations. Because no outbound request rate limiting was enforced, unauthenticated remote attackers could repeatedly invoke these commands to generate unbounded HTTP traffic toward arbitrary third-party targets, allowing the Cowrie honeypot to be abused as a denial-of-service amplification node and masking the attacker’s true source address behind the honeypot’s IP.</p> <p><strong>Affected:</strong> Cowrie</p> <p>Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl. In the default emulated shell configuration, these command emulations perform real outbound HTTP requests to attacker-supplied destinations. Because no outbound request rate limiting was enforced, unauthenticated remote attackers could repeatedly invoke these commands to generate unbounded HTTP traffic toward arbitrary third-party targets, allowing the Cowrie honeypot to be abused as a denial-of-service amplification node and masking the attacker’s true source address behind the honeypot’s IP.</p> https://cve.radiocsirt.org/vuln/cve-2025-34469 https://cve.radiocsirt.org/vuln/ghsa-83jg-m2pm-4jxj <p><strong>Affected:</strong> PyPI: cowrie</p> <p>### Summary</p> <p>A Server-Side Request Forgery (SSRF) vulnerability in Cowrie&#39;s emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts.</p> <p>### Details</p> <p>When Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The `wget` and `curl` command emulations actually perform real outbound HTTP requests to the destinations specified by the attacker, as this functionality is intended to allow Cowrie to save downloaded files for later inspection.</p> <p>An attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot&#39;s IP address, effectively masking the attacker&#39;s identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks.</p> <p>This vulnerability was observed being actively exploited in the wild.</p> <p>**Acknowledgements** This vulnerability was investigated by _[Abraham Gebrehiwot](https://www.iit.cnr.it/en/abraham.gebrehiwot/)_ and _Filippo Lauria_, with additional contributions from _Michele Castellaneta_, _Claudio Porta_ and _Sara Afzal_. All researchers are affiliated with the [Institute of Informatics and Telematics](https://www.iit.cnr.it/en…</p> <p><strong>Affected:</strong> PyPI: cowrie</p> <p>### Summary</p> <p>A Server-Side Request Forgery (SSRF) vulnerability in Cowrie&#39;s emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts.</p> <p>### Details</p> <p>When Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The `wget` and `curl` command emulations actually perform real outbound HTTP requests to the destinations specified by the attacker, as this functionality is intended to allow Cowrie to save downloaded files for later inspection.</p> <p>An attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot&#39;s IP address, effectively masking the attacker&#39;s identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks.</p> <p>This vulnerability was observed being actively exploited in the wild.</p> <p>**Acknowledgements** This vulnerability was investigated by _[Abraham Gebrehiwot](https://www.iit.cnr.it/en/abraham.gebrehiwot/)_ and _Filippo Lauria_, with additional contributions from _Michele Castellaneta_, _Claudio Porta_ and _Sara Afzal_. All researchers are affiliated with the [Institute of Informatics and Telematics](https://www.iit.cnr.it/en…</p> https://cve.radiocsirt.org/vuln/ghsa-83jg-m2pm-4jxj