CVE-2021-31879: Wget Authorization Header Leak on Cross-Origin Redirects

Wget before 1.21.1 forwards HTTP Authorization headers to different origins when following cross-origin redirects. An attacker-controlled server can respond with a 302 redirect to its own domain and capture the victim's credentials. This is a critical information-leak vulnerability that affects users who authenticate to legitimate websites and are then redirected to attacker-controlled servers.

Analyzed wget src/http.c, specifically the initialize_request() function which is called for each HTTP request in the redirect chain. The vulnerability exists because when processing a redirect to a different host, the code extracts user/password credentials from command-line options and .netrc files without verifying that the redirect target is on the same origin as the original request. The vulnerable condition at line 1949 checks if (*user && *passwd && (!u->user || opt.auth_without_challenge)) but lacks any cross-origin validation. When a redirect happens, gethttp() is called with a new URL structure u for the redirect target, but the user/password variables still contain credentials from the original request sources, and these are forwarded via maybe_send_basic_creds() without origin verification.", The fix requires adding a same-origin check before sending Authorization headers on redirects. Compare the original request's host, port, and scheme with the redirect target's values. Only send credentials (especially global credentials from command-line or netrc) if the origins match. Alternatively, prevent global credentials from being used across different origins while still respecting URL-embedded credentials within the same origin. The condition should be modified from if (*user && *passwd && (!u->user || opt.auth_without_challenge)) to if (same_origin && *user && *passwd && (!u->user || opt.auth_without_challenge)) where same_origin verifies original_url and u have identical host, port, and scheme.", The vulnerability can be verified by: (1) Setting up a test server that redirects to a different domain via 302 response, (2) Running wget with authentication (either URL-embedded or command-line credentials), (3) Observing the Authorization header in the redirect target's request logs. The fix should prevent the Authorization header from appearing in the redirect target's logs for cross-origin redirects. Unit tests should verify that: (a) same-origin redirects preserve credentials, (b) cross-origin redirects remove global credentials, (c) URL-embedded credentials are never forwarded to different hosts.", misconfiguration