3 ms·

This seems a little overblown, especially towards the later points. > 1. Malicious Executable loader with stealth functionality TL;DR the client downloads Pyt

This seems a little overblown, especially towards the later points. > 1. Malicious Executable loader with stealth functionality TL;DR the client downloads Python from python.org over HTTPS. This isn't great (especially since it's hard-coded to 3.12.4), but there's no obvious exploit path which doesn't involve both MITM and user interaction. > 2. Browser Hijacking + Executable Download (Software Upgrade Context) TL;DR the client downloads an RSS file over HTTPS and will conditionally prompt the user to open a URL found in that file. This is even lower risk than #1; even if you can MITM the user and get them to click "update", all you get to do with that is show the user a web page. > 3. RSS Feeds (Arbitrary URL injection) The researcher seems confused by the expected behavior of an RSS client. > 4. Decompression library attack surface (0-click) If you can find an exploit in zlib, there are much worse things you can do with that than attacking a torrent client. Decompressing input is assumed to be safe by default.

consp 2y ago
> If you can find an exploit in zlib, there are much worse things you can do with that than attacking a torrent client. Decompressing input is assumed to be safe by default. Any (e.g. http) server supporting stream compression comes to mind.
- duskwuff 2y ago
  Or, on the client side, any software that uses libpng to render PNG images (since that's using deflate on the inside). There's probably even more direct exploits against qbittorrent than MITMing the GeoIP database download.
sdefresne 2y ago
Those are minor if certificates errors are not ignored. Since the original issue is that the ssl errors are ignored, then all those https downloads are downgraded to http downloads in practice (no need to mitm to attack). Or to say it another way, due to ignoring ssl errors, all those https urls were giving a wrong sense of security as reviewers would think them secure when they were not (due to lack of validation of ssl).
- notpushkin 2y ago
  You still need to MITM the connection though. I think this is more of a risk if you live in dictatorship states, but even a rogue ISP or Wi-Fi hotspot would do. So yeah, definitely not theoretical.
deleted 2y ago
[deleted]
ufmace 2y ago
I agree. Calling this a "RCE Vulnerability" is ridiculously exaggerated. What's next, are we going to declare web browsers to have a "RCE Vulnerability" because they allow you to download programs from any site which may or may not be secure and then execute them? Or, hey everyone, did you know that if you live in an authoritarian state, the Government can do bad things to you?
result2vino 2y ago
Yep. I hate to be this negative, but…Christ, security ‘researchers’ will really grasp at the most remote straws for a bit of notoriety. I’d respect this more if it were documented honestly. How it’s been done here however has just left me rolling my eyes.
deleted 2y ago
[deleted]

consp 2y ago

> If you can find an exploit in zlib, there are much worse things you can do with that than attacking a torrent client. Decompressing input is assumed to be safe by default. Any (e.g. http) server supporting stream compression comes to mind.

duskwuff 2y ago
Or, on the client side, any software that uses libpng to render PNG images (since that's using deflate on the inside). There's probably even more direct exploits against qbittorrent than MITMing the GeoIP database download.

sdefresne 2y ago

Those are minor if certificates errors are not ignored. Since the original issue is that the ssl errors are ignored, then all those https downloads are downgraded to http downloads in practice (no need to mitm to attack). Or to say it another way, due to ignoring ssl errors, all those https urls were giving a wrong sense of security as reviewers would think them secure when they were not (due to lack of validation of ssl).

notpushkin 2y ago
You still need to MITM the connection though. I think this is more of a risk if you live in dictatorship states, but even a rogue ISP or Wi-Fi hotspot would do. So yeah, definitely not theoretical.

deleted 2y ago

[deleted]

ufmace 2y ago

I agree. Calling this a "RCE Vulnerability" is ridiculously exaggerated. What's next, are we going to declare web browsers to have a "RCE Vulnerability" because they allow you to download programs from any site which may or may not be secure and then execute them? Or, hey everyone, did you know that if you live in an authoritarian state, the Government can do bad things to you?

result2vino 2y ago

Yep. I hate to be this negative, but…Christ, security ‘researchers’ will really grasp at the most remote straws for a bit of notoriety. I’d respect this more if it were documented honestly. How it’s been done here however has just left me rolling my eyes.

deleted 2y ago

[deleted]