PT-2017-17116 · Bittorrent+1 · Qbittorrent+1

Published 2017-03-06 · Updated 2024-11-05 · CVE-2017-6503

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions qBittorrent versions prior to 3.3.11 qBittorrent versions prior to the version released in October 2024

Description The issue concerns a lack of proper escaping of values in the WebUI, potentially leading to XSS attacks. Additionally, there was a long-standing problem with the DownloadManager component not checking SSL/TLS certificates, making it vulnerable to MITM attacks. This lack of certificate verification was present since April 6, 2010. The problem was resolved in a version released in October 2024. There have been other security issues in the past, including the use of default credentials in the web interface allowing RCE through an external program function, special characters in torrent names leading to RCE through RSS feeds, and unescaped values leading to XSS attacks.

Recommendations For versions prior to 3.3.11, update to version 3.3.11 or later to resolve the XSS issue. For versions prior to the one released in October 2024, update to the latest version to address the MITM vulnerability through the DownloadManager component. As a temporary workaround, consider disabling the WebUI until a patch is available. Restrict access to the DownloadManager component to minimize the risk of MITM attacks until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2017-2101

CVE-2017-6503

DLA-897-1

Affected Products

Alt Linux

Qbittorrent

References · 15

• https://github.com/qbittorrent/qBittorrent/commit/6ca3e4f094da0a0017cb2d483ec1db6176bb0b16 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-6503 · Security Note
• https://ubuntu.com/security/CVE-2017-6503 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6503 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-2101 · Vendor Advisory
• https://qbittorrent.org/news.php · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6503 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6503 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6503 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6503 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6504 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6503 · Security Note
• https://t.me/nekaspersky/3986 · Telegram Post
• https://packages.altlinux.org/ru/vuln/CVE-2017-6503 · Note
• http://securityfocus.com/bid/96758 · Note