6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-10524

CVE-2024-10524: Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary...

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-10524

CVE-2024-10524:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit patch (c419542d956a2607bbce5df64b9d378a8588d778) clearly indicates that the vulnerability (CVE-2024-10524) was due to the way Wget handled shorthand URLs. The function rewrite_shorthand_url in src/url.c contained the specific logic for interpreting these shorthand URLs. The patch effectively removes this complex parsing logic by renaming the function to maybe_prepend_scheme and significantly simplifying its behavior to primarily just prepend http:// if no scheme is present and a colon doesn't indicate an invalid port. The removed sections from rewrite_shorthand_url show the parsing rules for different shorthand syntaxes (like host:path for FTP) which could be exploited when arbitrary user credentials were included in the URL, leading to misinterpretation of the target host. Therefore, rewrite_shorthand_url is identified as the vulnerable function because it directly processed the malicious input and contained the flawed logic. Other functions like main, get_urls_file, and getproxy were callers of this vulnerable function and represent pathways for the exploit but did not contain the vulnerable logic themselves.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.