Executive brief
Cowrie is a honeypot system designed to detect and analyze unauthorized SSH and Telnet login attempts. The emulated shell mode (default configuration) includes realistic implementations of wget and curl that actually perform real outbound HTTP requests. Attackers can exploit this by repeatedly invoking these commands to generate unbounded HTTP traffic toward arbitrary third-party targets, effectively abusing the honeypot as a DDoS amplification node while hiding behind the honeypot's IP address.
Technical details
This is a server-side request forgery (SSRF) vulnerability in Cowrie's emulated command implementations for wget and curl. The vulnerable component is the shell command emulation layer in emulated shell mode, which performs real outbound HTTP requests to attacker-supplied destinations. The attack vector is unauthenticated network access via SSH or Telnet (default weak credentials are often accepted). Since no rate limiting was enforced on outbound requests, attackers could invoke wget/curl commands in rapid succession to flood arbitrary third-party targets with HTTP traffic originating from the honeypot's IP address. The vulnerability was actively exploited in the wild. The fix was implemented in version 2.9.0 via PR #2800, which introduces rate limiting for outbound command emulations.
Affected products
- Cowrie Cowrie < 2.9.0
Timeline
- 2025-07-04: disclosed: Initial issue report of DDoS abuse observed in wild
- 2025-12-19: advisory: CVE-2025-34469 and GHSA-83jg-m2pm-4jxj published
- 2025-12-19: patched: Version 2.9.0 released with rate limiting fix via PR #2800