QBittorrent RCE Vulnerability: Since 14 years & 6 months

flyingcakes · November 3, 2024, 8:10am

Article: https://sharpsec.run/rce-vulnerability-in-qbittorrent/

tl;dr:

In qBittorrent, the DownloadManager class has ignored every SSL certificate validation error that has ever happened, on every platform, for 14 years and 6 months since April 6 2010 with commit 9824d86.

See line 154 below:

github.com

qbittorrent/qBittorrent/blob/a126a7b4934d9e66fcedb60769523eb891da7086/src/base/net/downloadmanager.cpp#L154


      
              m_networkManager->setCookieJar(m_networkCookieJar);
              connect(m_networkManager, &QNetworkAccessManager::sslErrors, this
                      , [](QNetworkReply *reply, const QList<QSslError> &errors)
              {
                  QStringList errorList;
                  for (const QSslError &error : errors)
                      errorList += error.errorString();
                  LogMsg(tr("Ignoring SSL error, URL: \"%1\", errors: \"%2\"").arg(reply->url().toString(), errorList.join(u". ")), Log::WARNING);
          
                  // Ignore all SSL errors
                  reply->ignoreSslErrors();
              });
          
              connect(ProxyConfigurationManager::instance(), &ProxyConfigurationManager::proxyConfigurationChanged
                      , this, &DownloadManager::applyProxySettings);
              connect(Preferences::instance(), &Preferences::changed, this, &DownloadManager::applyProxySettings);
              applyProxySettings();
          }
          
          void Net::DownloadManager::initInstance()
          {

As per the post author, possible exploits include:

Automated replacement of all Python exes with arbitrary exe: RCE with a single click

Automated replacement of all qBittorrent update URLs in RSS feed: Browser Hijacking/RCE with moderate user interaction

Automated replacement of all/specific links in qBittorrent RSS viewer: RCE until 2019, Download Hijacking

The exploit has been fixed in version 5.0.1 and its there on Arch repos. Updating to latest version via pacman should keep your system fine.

Ben · November 3, 2024, 9:23am

I got the impression that simply not running it on Windows would keep your system fine - my system has been fine for many years already