uTorrent Guest Account privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in uTorrent. Affected by this issue is some unknown functionality of the component Guest Account. The manipulation leads to privileges management. This vulnerability is uniquely identified as CVE-2018-25044. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in uTorrent (Peer-to-Peer Software) (affected version unknown). This issue affects an unknown functionality of the component Guest Account. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 01/31/2018 by Tavis Ormandy (taviso) as confirmed bug report (Website). It is possible to read the advisory at bugs.chromium.org. The public release has been coordinated in cooperation with the project team. The identification of this vulnerability is CVE-2018-25044. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. The advisory points out:

Finally, a minor issue - the documentation for the "guest" account feature says many actions are disabled for security, but I tested it and that it plain isn't true.

A public exploit has been developed by Tavis Ormandy (taviso) in HTTP GET Request and been published immediately after the advisory. The exploit is available at bugs.chromium.org. It is declared as functional. The code used by the exploit is:

$ curl -si 'http://guest@localhost:10000/gui/?action=getsettings&callback=error&btapp='
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 16572
Content-Type: text/javascript
Set-Cookie: GUID=6yY1pkIHHMvvHo8tgOYu; path=/
Cache-Control: no-cache

{"build":44090,"settings": [
["install_modification_time",0,"0",{"access":"Y"}]
…

Upgrading eliminates this vulnerability.

math.sci.hiroshima-u.ac.jp is providing further details. The entries VDB-113803, VDB-113804, VDB-113805 and VDB-113806 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Peer-to-Peer Software

Name

• uTorrent

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion