CVE-2025-60876

Executive Summary

CVE-2025-60876 is a critical HTTP request smuggling vulnerability in BusyBox wget versions up to and including 1.3.7. The flaw allows an attacker to inject arbitrary HTTP headers by exploiting the acceptance of raw CR (0x0D) and LF (0x0A) control bytes, as well as other C0 control characters, within the HTTP request-target (path/query). This enables request-line splitting, where the attacker can break the intended METHOD SP request-target SP HTTP/1.1 structure and inject malicious headers. The vulnerability is particularly dangerous because it can be used to poison web caches, bypass security controls, or perform cross-site scripting (XSS) attacks against downstream clients. No official patch has been released, and the vendor status is marked as UNKNOWN/UNPATCHED.

Supply Chain & Package Security

BusyBox is a critical component in many embedded Linux systems, container images (e.g., Alpine Linux), and IoT devices. The wget utility is often used for downloading files, updates, or configuration data. An attacker who can control the URL or redirect a wget request can inject headers that may be forwarded to backend services, potentially compromising the entire supply chain. Organizations using BusyBox in their base images or firmware should treat this as a high-priority supply chain risk.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or error. Based on the technical details, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• Attack Vector (AV): Network – the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – the victim does not need to perform any action.
• Scope (S): Unchanged – the attacker cannot affect other components.
• Confidentiality (C): Low – limited information disclosure possible.
• Integrity (I): Low – header injection can modify responses.
• Availability (A): None – no direct denial of service.

Threat Level: High – due to the ease of exploitation and potential for cache poisoning and XSS.

Deep Dive & Mechanics

The vulnerability resides in how BusyBox wget parses the HTTP request-target (the path and query string portion of the URL). According to RFC 7230, the request-target must not contain raw control characters (0x00-0x1F, except 0x09 HT). However, BusyBox wget up to version 1.3.7 accepts raw CR (0x0D) and LF (0x0A) bytes, as well as other C0 control characters, in the request-target.

When wget constructs the HTTP request line, it uses the format:

GET /path HTTP/1.1\r\n

If the path contains a raw LF (0x0A), the request line becomes:

GET /path\nHTTP/1.1\r\n

This allows an attacker to inject a newline and then add arbitrary headers. For example, a URL like:

http://example.com/foo%0d%0aX-Injected:%20true%0d%0a

would cause wget to send:

GET /foo\r\nX-Injected: true\r\n HTTP/1.1\r\n

This effectively splits the request line and injects the X-Injected: true header. The trailing HTTP/1.1 becomes part of the next header or body, potentially causing parsing errors or further injection.

The vulnerability is exacerbated because wget does not reject raw space (0x20) in the request-target, which is also forbidden by RFC 7230. Clients should use percent-encoding (%20) for spaces.

Vulnerable vs. Patched Code

Vulnerable Code (BusyBox wget <= 1.3.7): The vulnerable code likely resides in the HTTP request construction function. A simplified pseudocode representation:

// Vulnerable: no validation of control characters in path
void build_request(const char *path) {
    char request[1024];
    snprintf(request, sizeof(request), "GET %s HTTP/1.1\r\n", path);
    send(sock, request, strlen(request), 0);
}

Patched Code (Hypothetical): A patched version would sanitize the path by rejecting or percent-encoding control characters:

// Patched: reject control characters
int is_safe_path(const char *path) {
    for (const char *p = path; *p; p++) {
        if ((unsigned char)*p <= 0x1F && *p != '\t') {
            return 0; // reject
        }
    }
    return 1;
}

void build_request(const char *path) {
    if (!is_safe_path(path)) {
        error("Invalid path");
        return;
    }
    char request[1024];
    snprintf(request, sizeof(request), "GET %s HTTP/1.1\r\n", path);
    send(sock, request, strlen(request), 0);
}

Exploitation & Lab Setup

Red Team

Exploit Scenario: An attacker controls a malicious web server or can perform a man-in-the-middle attack. The victim uses BusyBox wget to fetch a URL. The attacker crafts a URL with injected headers.

Proof-of-Concept (PoC):

# Start a malicious HTTP server that returns a redirect with a crafted URL
# Or directly craft the URL if the attacker controls the initial request
wget "http://example.com/foo%0d%0aX-Injected:%20true%0d%0a"

Advanced Exploit: To perform HTTP request smuggling against a backend proxy:

# Inject headers that will be interpreted by a downstream proxy
wget "http://proxy.example.com/foo%0d%0aTransfer-Encoding:%20chunked%0d%0a%0d%0a0%0d%0a%0d%0aGET%20/admin%20HTTP/1.1%0d%0aHost:%20internal.example.com%0d%0a%0d%0a"

Lab Setup:

1. Set up a vulnerable BusyBox environment (e.g., Alpine Linux with BusyBox 1.3.7).
2. Use a tool like netcat to listen for incoming HTTP requests.
3. Execute the wget command with the crafted URL.
4. Observe the injected headers in the captured request.

Blue Team

Detection:

• Monitor for URLs containing raw control characters (0x00-0x1F) in HTTP requests.
• Look for unusual patterns in HTTP request lines, such as multiple HTTP/1.1 strings or unexpected headers.

Mitigation:

• Upgrade BusyBox to a patched version (once available).
• Use a web application firewall (WAF) to block requests with control characters in the path.
• Implement network segmentation to limit exposure of vulnerable devices.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with raw control characters (0x0D, 0x0A, 0x00-0x1F) in the request-target.
  • HTTP request lines containing multiple HTTP/1.1 strings.
  • Unexpected headers like X-Injected or Transfer-Encoding in requests from wget.

• File IOCs:

  • BusyBox binary with version <= 1.3.7.
  • Log entries showing wget requests with percent-encoded control characters (e.g., %0d%0a).

• Behavioral IOCs:

  • wget processes making requests to suspicious URLs.
  • Unusual outbound connections from embedded devices or containers.

Detection Engineering

YARA Rule

rule CVE_2025_60876_BusyBox_wget_Header_Injection {
    meta:
        description = "Detects BusyBox wget binary vulnerable to CVE-2025-60876"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60876"
    strings:
        $wget_magic = "wget" nocase
        $version_1_3 = "1.3." ascii
        $version_1_2 = "1.2." ascii
        $version_1_1 = "1.1." ascii
        $version_1_0 = "1.0." ascii
    condition:
        $wget_magic and ($version_1_3 or $version_1_2 or $version_1_1 or $version_1_0)
}

Sigma Rule

title: CVE-2025-60876 - BusyBox wget HTTP Header Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests from BusyBox wget containing raw control characters in the request-target
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-60876
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains:
            - '%0d%0a'
            - '%0a'
            - '%0d'
            - '%00'
    condition: selection
falsepositives:
    - Legitimate use of percent-encoded characters in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60876 BusyBox wget HTTP Header Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"%0d%0a"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or restrict the use of BusyBox wget in production environments until a patch is available.
2. Workaround: Use an alternative HTTP client (e.g., curl, wget from GNU) that properly validates request-target characters.
3. Network Controls: Deploy a WAF with rules to block HTTP requests containing raw control characters (0x00-0x1F) in the URI.
4. Monitoring: Enable detailed logging of HTTP requests and monitor for suspicious patterns.
5. Patch Management: Subscribe to BusyBox security advisories and apply patches as soon as they are released.
6. Container Security: For containerized environments, rebuild base images with patched BusyBox or replace with a secure alternative.

Valters IT
Securing Digital Frontiers