Critical security vulnerability patched in qBittorrent

A critical security vulnerability is reported in qBittorrent, affecting versions 3.2.1 through 5.0.0, allowing remote code execution (RCE) through various attack vectors due to failure in SSL/TLS certificate validation within the application's DownloadManager class.

Introduced in April 2010, this flaw persisted for over 14 years, enabling attackers to conduct man-in-the-middle (MITM) attacks and inject malicious code into affected systems by exploiting the platform’s indiscriminate acceptance of certificates.

The flaw, (no CVE ID) stems from DownloadManager, a component that handles downloading processes without validating SSL/TLS certificates, including expired or self-signed ones. This oversight opens up several security risks, as it fails to authenticate servers’ legitimacy and allows attackers to manipulate network traffic, potentially leading to malware infections or unauthorized data access.

Security researchers from Sharp Security highlighted multiple exploit vectors due to this vulnerability:

• Malicious Python Loader: On Windows, qBittorrent prompts users to install Python from a hardcoded URL if it’s required for search plugins. Without certificate validation, an attacker can intercept this prompt, replacing it with a malicious Python executable to achieve RCE.
• Fake Update Injection: qBittorrent retrieves update information from an XML feed hosted on a hardcoded URL. By intercepting this request, an attacker could modify the update link, directing users to a compromised executable.
• RSS Feed Manipulation: The app’s RSS feed parsing, which lacks validation, allows attackers to insert malicious URLs as legitimate torrent links. This can lead users to inadvertently download malware.
• GeoIP Database Exploit: qBittorrent automatically downloads and decompresses the MaxMind GeoIP database from a fixed URL. If an attacker replaces this file with a maliciously crafted archive, it could exploit vulnerabilities in decompression libraries, such as buffer overflow issues in zlib.

The vulnerability was addressed with a patch in version 5.0.1, released on October 28, 2024, following a default behavior change on October 12, 2024, which now mandates SSL/TLS certificate verification. Users on affected versions are urged to:

• Upgrade Immediately to Version 5.0.1 or Later: This patch ensures that SSL/TLS certificates are validated, preventing MITM attacks.
• Consider Alternative Torrent Clients: Deluge and Transmission are potential alternatives without this SSL/TLS flaw.