HTTP header injection via CRLF in BusyBox wget request-target
BusyBox wget improperly validates the HTTP request-target, allowing CR/LF and other control bytes (including space) in URLs. A crafted URL or redir...
Description
BusyBox wget improperly validates the HTTP request-target, allowing CR/LF and other control bytes (including space) in URLs. A crafted URL or redirect can split the request line and inject attacker-controlled headers (e.g., Authorization/Cookie), enabling cache poisoning or access-control bypass.