Cowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS Amplification

Vulnerability

Overview

Cowrie, an SSH/Telnet honeypot that emulates a UNIX shell, includes emulated implementations of wget and curl commands. In versions prior to 2.9.0, these emulated commands performed real outbound HTTP requests to attacker-supplied destinations supplied by an attacker, with no rate limiting applied [1][2][4]. This server-side request forgery (SSRF) flaw exists in the emulated shell mode allows the honeypot to be used as an amplification node for denial-of-service attacks.

Exploitation and

Attack Surface

An unauthenticated remote attacker connecting via SSH or Telnet can repeatedly issue wget or curl commands targeting arbitrary third-party hosts [1][2]. Because the honeypot performs real HTTP requests from its own IP address, the attacker can generate unbounded traffic toward a victim while masking their true source [4]. The default emulated shell configuration makes every Cowrie instance vulnerable out of the box. Real-world exploitation has been observed in the wild, with automated sessions issuing thousands of such requests [1][4].

Impact

Successful exploitation enables an attacker to amplify HTTP-based DDoS attacks. The honeypot becomes an unwitting participant, generating continuous outbound traffic that can overwhelm a victim host. Additionally, the attacker's identity is concealed behind the honeypot's IP address, complicating attribution and mitigation [2][4].

Mitigation

The vulnerability is fixed in Cowrie version 2.9.0, which introduces rate limiting for outbound requests from command emulations [2][4]. Operators are strongly advised to update their installations. No workarounds are documented; running in proxy or LLM mode may reduce exposure but is not an explicit vendor-recommended mitigation [3].