Cowrie
Monthly
Server-side request forgery in Cowrie honeypots prior to 2.9.0 allows unauthenticated remote attackers to turn the emulated wget and curl commands into an outbound HTTP request amplifier directed at arbitrary third parties, because the default emulated shell performs real HTTP fetches with no outbound rate limiting. Anyone who can reach the honeypot's SSH or Telnet listener (PR:N, since honeypots accept arbitrary credentials by design) can loop these commands and generate unbounded traffic that appears to originate from the honeypot's IP, enabling DoS amplification and source-address spoofing while causing only limited availability impact on the honeypot itself. Publicly available exploit code exists, including a documented PoC that chains repeated wget invocations over SSH, and the upstream GitHub advisory states the issue was observed being exploited in real deployments; the CVSS 4.0 base score is 6.9 (Medium) and the assessed vector is limited to availability (VA:L on the honeypot, SA:L on third-party targets), not host compromise or data loss.
Server-side request forgery in Cowrie honeypots prior to 2.9.0 allows unauthenticated remote attackers to turn the emulated wget and curl commands into an outbound HTTP request amplifier directed at arbitrary third parties, because the default emulated shell performs real HTTP fetches with no outbound rate limiting. Anyone who can reach the honeypot's SSH or Telnet listener (PR:N, since honeypots accept arbitrary credentials by design) can loop these commands and generate unbounded traffic that appears to originate from the honeypot's IP, enabling DoS amplification and source-address spoofing while causing only limited availability impact on the honeypot itself. Publicly available exploit code exists, including a documented PoC that chains repeated wget invocations over SSH, and the upstream GitHub advisory states the issue was observed being exploited in real deployments; the CVSS 4.0 base score is 6.9 (Medium) and the assessed vector is limited to availability (VA:L on the honeypot, SA:L on third-party targets), not host compromise or data loss.