remote execution

In late October 2024, the qBittorrent project released version 5.0.1, which addressed a 14-year-long issue of improper validation of SSL/TLS certificates, mitigating a vulnerability that exposed users to man-in-the-middle (MitM) attacks. The vulnerability allowed for remote code execution due to the application’s failure to verify SSL/TLS certificates in the DownloadManager component, first documented in a commit from April 6, 2010. Since then, qBittorrent had accepted any certificate, enabling malicious actors to manipulate network traffic. The default behavior was changed to enforce verification on October 12, 2024. Sharp Security identified four primary risks associated with this vulnerability: 1. An attacker could intercept a request for a Python installer and substitute it with a malicious version. 2. An attacker could replace the update link with a malicious one during the update check. 3. Attackers could modify RSS feed content, inserting malicious URLs. 4. Exploitation through potential buffer overflow vulnerabilities when downloading a GeoIP database from a counterfeit server. An example of exploitation included remote execution of the system application "Calculator." The qBittorrent 5.0 client was released in late September 2024, developed using the Qt toolkit, with source code available on GitHub under the GPLv2+ license.