PT-2018-11811 · Azureus · Vuze Bittorrent Client

Chris Moberly · Published 2018-08-13 · Updated 2018-10-18 · CVE-2018-13417

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vuze Bittorrent Client version 5.7.6.0

Description The XML parsing engine for SSDP/UPnP functionality in Vuze Bittorrent Client is vulnerable to an XML External Entity Processing (XXE) attack. This allows remote, unauthenticated attackers to access arbitrary files from the filesystem with the same permission as the user account running Vuze. Additionally, attackers can initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or relay a NetNTLM challenge/response to achieve Remote Command Execution in Windows domains.

Recommendations For Vuze Bittorrent Client version 5.7.6.0, consider disabling the SSDP/UPnP functionality as a temporary workaround until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using the vulnerable XML parsing engine for SSDP/UPnP functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-13417

Affected Products

Vuze Bittorrent Client

References · 4

• 🔥 http://seclists.org/fulldisclosure/2018/Aug/2 · Exploit
• 🔥 https://exploit-db.com/exploits/45145 · Exploit
• https://osv.dev/vulnerability/CVE-2018-13417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13417 · Security Note