Cowrie présente une vulnérabilité SSRF dans l'émulation wget/curl permettant une amplification DDoS

The SSRF vulnerability in Cowrie's emulated shell mode presents a significant risk for DoS amplification. Attackers can craft malicious commands using wget or curl within the emulated shell, causing Cowrie to make outbound HTTP requests to arbitrary third-party hosts. Because Cowrie operates as a honeypot, it often has a public-facing IP address, making it an attractive target for attackers seeking to amplify their DoS attacks. This can lead to service disruptions and resource exhaustion for the targeted hosts, potentially impacting critical infrastructure or online services. The lack of authentication required to exploit this vulnerability further exacerbates the risk, as any unauthenticated user can potentially launch attacks.

Organizations deploying Cowrie honeypots, particularly those with public-facing instances, are at risk. Shared hosting environments where Cowrie is deployed alongside other services are also vulnerable, as a compromised Cowrie instance could be used to launch attacks against other tenants. Legacy Cowrie configurations that haven't been updated recently are particularly susceptible.

• python / server:

journalctl -u cowrie | grep -i "http request"

• generic web:

curl -I <cowrie_ip>/wget <arbitrary_url>

• generic web:

curl -I <cowrie_ip>/curl <arbitrary_url>

1. 2025-12-20Disclosure

   disclosure

1. Réservé2025-04-15
2. Publiée2025-12-20
3. Modifiée2026-02-04
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-34469 is to upgrade Cowrie to version 2.9.0 or later, which includes the fix for the SSRF vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restricting outbound network access from the Cowrie honeypot to only essential services can limit the potential for abuse. Implementing a Web Application Firewall (WAF) or proxy with strict outbound filtering rules can also help prevent malicious HTTP requests. Monitoring Cowrie's logs for unusual outbound traffic patterns is crucial for early detection of potential attacks. After upgrading, confirm the fix by attempting to execute wget or curl commands within the emulated shell and verifying that the requests are properly blocked.