cowrie
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
View on Github
Activity
- Latest release
- 4d ago
- Total releases
- 16
- Cadence
- ~6 days
- Last 12 months
- 13
Reach
- Stars
- 6.6k
Details
- License
- BSD-3-Clause
- First release
- Oct 07, 2025
| Version | Released | |
|---|---|---|
3.1.4
patch
| ||
3.1.3
patch
| ||
3.1.2
patch
| ||
3.1.1
patch
| ||
3.1.0
minor
| ||
3.0.15
patch
| ||
3.0.14
patch
| ||
3.0.13
patch
| ||
3.0.12
patch
| ||
3.0.11
patch
| ||
3.0.10
patch
| ||
3.0.0
major
| ||
2.9.0
minor
| ||
2.8.1
patch
1 CVE
CVE-2025-34469
PYSEC-2026-1280
GHSA-83jg-m2pm-4jxj
Jul 07, 2026
Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification
Medium
Network
Low
None
None
SummaryA Server-Side Request Forgery (SSRF) vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts. DetailsWhen Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The An attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot's IP address, effectively masking the attacker's identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks. This vulnerability was observed being actively exploited in the wild. Acknowledgements This vulnerability was investigated by Abraham Gebrehiwot and Filippo Lauria, with additional contributions from Michele Castellaneta, Claudio Porta and Sara Afzal. All researchers are affiliated with the Institute of Informatics and Telematics (IIT), Italian National Research Council (CNR). Fix
This issue has been fixed in version 2.9.0 via PR #2800, which introduces a rate limiting mechanism for outbound requests in command emulations such as PoCThis is a rudimentary proof of concept demonstrating the amplification potential of this vulnerability. Setup:
On the victim machine, start an HTTP server: On the attacker machine, execute: This command builds a Result: The victim's HTTP server logs show 1,000 requests originating exclusively from the honeypot's IP address (192.168.1.10), received within approximately 5 seconds (truncated for brevity): Notice that the attacker's IP (192.168.1.20) never appears in the victim's logs, demonstrating how the honeypot masks the attacker's identity. ImpactThis is a Server-Side Request Forgery (SSRF) vulnerability that enables abuse of Cowrie honeypots as DDoS amplification nodes. Who is impacted: Any organization running Cowrie in emulated shell mode (the default configuration) with versions prior to 2.9.0. Consequences:
Affected versions
2.7.0
2.8.0
2.8.1
Fixed in
2.9.0
References Updated Jul 07, 2026 · Source: OSV.dev | ||
2.8.0
minor
1 CVE
CVE-2025-34469
PYSEC-2026-1280
GHSA-83jg-m2pm-4jxj
Jul 07, 2026
Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification
Medium
Network
Low
None
None
SummaryA Server-Side Request Forgery (SSRF) vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts. DetailsWhen Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The An attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot's IP address, effectively masking the attacker's identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks. This vulnerability was observed being actively exploited in the wild. Acknowledgements This vulnerability was investigated by Abraham Gebrehiwot and Filippo Lauria, with additional contributions from Michele Castellaneta, Claudio Porta and Sara Afzal. All researchers are affiliated with the Institute of Informatics and Telematics (IIT), Italian National Research Council (CNR). Fix
This issue has been fixed in version 2.9.0 via PR #2800, which introduces a rate limiting mechanism for outbound requests in command emulations such as PoCThis is a rudimentary proof of concept demonstrating the amplification potential of this vulnerability. Setup:
On the victim machine, start an HTTP server: On the attacker machine, execute: This command builds a Result: The victim's HTTP server logs show 1,000 requests originating exclusively from the honeypot's IP address (192.168.1.10), received within approximately 5 seconds (truncated for brevity): Notice that the attacker's IP (192.168.1.20) never appears in the victim's logs, demonstrating how the honeypot masks the attacker's identity. ImpactThis is a Server-Side Request Forgery (SSRF) vulnerability that enables abuse of Cowrie honeypots as DDoS amplification nodes. Who is impacted: Any organization running Cowrie in emulated shell mode (the default configuration) with versions prior to 2.9.0. Consequences:
Affected versions
2.7.0
2.8.0
2.8.1
Fixed in
2.9.0
References Updated Jul 07, 2026 · Source: OSV.dev | ||
2.7.0
initial
1 CVE
CVE-2025-34469
PYSEC-2026-1280
GHSA-83jg-m2pm-4jxj
Jul 07, 2026
Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification
Medium
Network
Low
None
None
SummaryA Server-Side Request Forgery (SSRF) vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts. DetailsWhen Cowrie operates in emulated shell mode (the default configuration), it basically emulates common Linux commands. The An attacker who connects to the honeypot via SSH or Telnet can repeatedly invoke these commands targeting a victim host. Since there was no rate limiting mechanism in place, the attacker could generate unlimited outbound HTTP traffic toward the victim. The requests originate from the honeypot's IP address, effectively masking the attacker's identity and turning the honeypot into an unwitting participant in distributed denial-of-service (DDoS) attacks. This vulnerability was observed being actively exploited in the wild. Acknowledgements This vulnerability was investigated by Abraham Gebrehiwot and Filippo Lauria, with additional contributions from Michele Castellaneta, Claudio Porta and Sara Afzal. All researchers are affiliated with the Institute of Informatics and Telematics (IIT), Italian National Research Council (CNR). Fix
This issue has been fixed in version 2.9.0 via PR #2800, which introduces a rate limiting mechanism for outbound requests in command emulations such as PoCThis is a rudimentary proof of concept demonstrating the amplification potential of this vulnerability. Setup:
On the victim machine, start an HTTP server: On the attacker machine, execute: This command builds a Result: The victim's HTTP server logs show 1,000 requests originating exclusively from the honeypot's IP address (192.168.1.10), received within approximately 5 seconds (truncated for brevity): Notice that the attacker's IP (192.168.1.20) never appears in the victim's logs, demonstrating how the honeypot masks the attacker's identity. ImpactThis is a Server-Side Request Forgery (SSRF) vulnerability that enables abuse of Cowrie honeypots as DDoS amplification nodes. Who is impacted: Any organization running Cowrie in emulated shell mode (the default configuration) with versions prior to 2.9.0. Consequences:
Affected versions
2.7.0
2.8.0
2.8.1
Fixed in
2.9.0
References Updated Jul 07, 2026 · Source: OSV.dev |