PT-2025-54458 · Cowrie · Cowrie

Published 2025-12-20 · Updated 2026-01-02 · CVE-2025-34469

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cowrie versions prior to 2.9.0

Description Cowrie versions before 2.9.0 have a server-side request forgery (SSRF) issue in the emulated shell implementations of wget and curl. The default configuration allows these commands to make real outbound HTTP requests to destinations specified by an attacker. The lack of outbound request rate limiting enables unauthenticated remote attackers to repeatedly execute these commands, generating a large volume of HTTP traffic towards arbitrary third-party targets. This can be used to abuse the Cowrie honeypot as a denial-of-service amplification node and conceal the attacker's original IP address behind the honeypot's IP address. The vulnerable commands perform real outbound HTTP requests to attacker-supplied destinations.

Recommendations Update Cowrie to version 2.9.0 or later.

Exploit

Fix

DoS

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-34469

GHSA-83JG-M2PM-4JXJ

Affected Products

Cowrie

References · 14

• 🔥 https://github.com/cowrie/cowrie/issues/2622 · Exploit
• 🔥 https://github.com/advisories/GHSA-83jg-m2pm-4jxj · Exploit
• https://github.com/cowrie/cowrie/pull/2800 · Patch
• https://github.com/cowrie/cowrie/releases/tag/v2.9.0 · Patch
• https://osv.dev/vulnerability/GHSA-83jg-m2pm-4jxj · Vendor Advisory
• https://cve.org/cverecord?id=CVE-2025-34469 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34469 · Security Note
• https://github.com/cowrie/cowrie · Note
• https://github.com/cowrie/cowrie/security/advisories/GHSA-83jg-m2pm-4jxj · Note
• https://t.me/cveNotify/147557 · Telegram Post
• https://vulncheck.com/advisories/cowrie-unrestricted-wget-curl-emulation-enables-ssrf-based-ddos-amplification · Note
• https://twitter.com/CVEnew/status/2006495358814204387 · Twitter Post
• https://t.me/CVEtracker/41130 · Telegram Post