Deluge is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue allows a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Versions prior to Deluge 1.3.14 are vulnerable.
Information
Deluge Deluge 1.3.13
Debian Linux 6.0 sparc
Debian Linux 6.0 s/390
Debian Linux 6.0 powerpc
Debian Linux 6.0 mips
Debian Linux 6.0 ia-64
Debian Linux 6.0 ia-32
Debian Linux 6.0 arm
Debian Linux 6.0 amd64
Exploit
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
References:
- [WebUI] Only accept application/json content-type requests (deluge-torrent.org)
- [WebUI] Only accept application/json content-type requests (deluge-torrent.org)
- Deluge Homepage (deluge)
- Remote code execution via CSRF vulnerability in the web UI of Deluge 1.3.13 (Seclists.org)