[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANOyCOFT24kym0XnyUnVMeKn=GG07s8y7wpVSLWfHMeW0nriww@mail.gmail.com>
Date: Thu, 31 Oct 2024 00:43:02 +0100
From: Sec Guy <0xsee4@...il.com>
To: oss-security@...ts.openwall.com
Subject: qBittorrent RCE, Browser Hijacking vulnerabilities
Hi all,
qBittorrent, on all platforms, did not verify any SSL certificates in its
DownloadManager class from 2010 until October 2024. If it failed to verify
a cert, it simply logged an error and proceeded.
To be exploitable, this bug requires either MITM access or DNS spoofing
attacks, but under those conditions (seen regularly in some countries),
impacts are severe.
The primary impact is single-click RCE for Windows builds from 2015 onward,
when prompted to update python the exe is downloaded from a hardcoded URL,
executed, and then deleted afterwards.
The secondary impact for all platforms is the update RSS feed can be
poisoned with malicious update URLs which the user will open in their
browser if they accept the prompt to update. This is browser hijacking and
arbitrary exe delivery to a user who would likely trust whatever URL this
software sent them to.
The tertiary impact is this means that an older CVE (CVE-2019-13640
<https://www.cvedetails.com/cve/CVE-2019-13640/>) which allowed remote
command execution via shell metacharacters could have been exploited by
(government) attackers conducting either MITM or DNS spoofing attacks at
the time, instead of only by the author of the feed.
Full write up is here:
https://sharpsec.run/rce-vulnerability-in-qbittorrent/
I have applied for a CVE but have had no response yet. Mitigation is to use
any other torrent client. The latest release is patched against this issue.
Credit: Jordan Sharp (finder)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
