Description
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
transmission transmission
Default version status: unaffected
4.0.0 to < 4.1.3affected
pkg:github/transmission/transmissionReferences
- https://github.com/transmission/transmission/pull/8938 ↗
- https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e ↗
- https://github.com/transmission/transmission ↗
- https://github.com/transmission/transmission/releases/tag/4.1.3 ↗
- https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560 ↗
- https://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit ↗
- https://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token ↗