Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

54772 readers

410 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others

Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):

💰 Please help cover server costs.


Ko-fi	Liberapay

founded 1 year ago

MODERATORS

[email protected]

RCE Vulnerability in QBittorrent – Sharp Security (sharpsec.run)

submitted 3 weeks ago by [email protected] to c/[email protected]

17 comments fedilink hide all child comments

I dont know who needs to hear this bit qBittorrent has a nasty vulnerability ( and there are some older ones too)

qBittorrent, on all platforms, did not verify any SSL certificates in its DownloadManager class from 2010 until October 2024. If it failed to verify a cert, it simply logged an error and proceeded.

To be exploitable, this bug requires either MITM access or DNS spoofing attacks, but under those conditions (seen regularly in some countries), impacts are severe.

The primary impact is single-click RCE for Windows builds from 2015 onward, when prompted to update python the exe is downloaded from a hardcoded URL, executed, and then deleted afterwards.

The secondary impact for all platforms is the update RSS feed can be poisoned with malicious update URLs which the user will open in their browser if they accept the prompt to update. This is browser hijacking and arbitrary exe delivery to a user who would likely trust whatever URL this software sent them to.

The tertiary impact is this means that an older CVE (CVE-2019-13640 https://www.cvedetails.com/cve/CVE-2019-13640/) which allowed remote command execution via shell metacharacters could have been exploited by (government) attackers conducting either MITM or DNS spoofing attacks at the time, instead of only by the author of the feed.

Full write up is here: https://sharpsec.run/rce-vulnerability-in-qbittorrent/

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 5 points 3 weeks ago (2 children)

Is there something we should do in the meantime? I’m not the most savvy individual when it comes to tech on this level.

[–] [email protected] 16 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

Not really. This requires a sophisticated attacker. I’d suggest updating soon but I doubt most people are at risk. As always verify downloads before running them and check where you should be getting updates and if you’re sent to a sketchy file host try to find updates from the official website instead.

The biggest risk is MTM interception and replacement of the python executable if you try and use the search tool for the first time. I suppose avoid doing that until you update the client from their website.

[–] [email protected] 2 points 3 weeks ago

Thanks. This makes it a lot clearer.

[–] [email protected] 7 points 3 weeks ago (1 children)

Just update it to the latest

[–] [email protected] 7 points 3 weeks ago (1 children)

Ah. So this has already been addressed? Okay, thanks for responding.

[–] Blxter 2 points 3 weeks ago

Yea that was very unclear to me that it was already addressed.