CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its __init__.py file and (2) causing the victim to download, install, and enable this plugin.

This update for deluge fixes two security issues :

  - CVE-2017-9031: A remote attacker may have used a     directory traversal vulnerability in the web interface     (bsc#1039815)

  - CVE-2017-7178: A remote attacher could have exploited a     CSRF vulnerability to trick a logged-in user to perform     actions in the WebUI (bsc#1039958)

In addition, deluge was updated to 1.3.15 with the following fixes and changes :

  - Core: Fix issues with displaying libtorrent-rasterbar     single proxy.

  - Core: Fix libtorrent-rasterbar 1.2 trackers crashing     Deluge UIs.

  - Core: Fix an error in torrent priorities causing file     priority mismatch in UIs.

  - GtkUI: Fix column sort state not saved in Thinclient     mode.

  - GtkUI: Fix a connection manager error with malformed ip.

  - GtkUI: Rename SystemTray/Indicator 'Pause/Resume All' to     'Pause/Resume Session'.

  - GtkUI: Workaround libtorrent-rasterbar single proxy by     greying out unused proxy types.

  - Notification Plugin: Fix webui passing string for int     port value.

  - AutoAdd Plugin: Add WebUI preferences page detailing     lack of configuration via WebUI.

  - Label Plugin: Add WebUI preferences page detailing how     to configure plugin.

  - Core: Fix 'Too many files open' errors.

  - Core: Add support for python-GeoIP for use with     libtorrent 1.1.

  - Core: Fix a single proxy entry being overwritten     resulting in no proxy set.

  - UI: Add the tracker_status translation to UIs.

  - GtkUI: Strip whitespace from infohash before checks.

  - GtkUI: Add a missed feature autofill infohash entry from     clipboard.

  - WebUI: Backport bind interface option for server.

  - ConsoleUI: Fix a decode error comparing non-ascii (str)     torrent names.

  - AutoAdd Plugin: Fixes for splitting magnets from file.

  - Remove the duplicate magnet extension when splitting.

  - Remove deluge-libtorrent-1.1-geoip.patch: fixed     upstream.

Two vulnerabilities have been discovered in the web interface of the Deluge BitTorrent client (directory traversal and cross-site request forgery).

The remote host is affected by the vulnerability described in GLSA-201703-06 (Deluge: Remote execution of arbitrary code)

    A CSRF vulnerability was discovered in the web UI of Deluge.
  Impact :

    A remote attacker could entice a user currently logged in into Deluge       web UI to visit a malicious web page which uses forged requests to make       Deluge download and install a Deluge plug-in provided by the attacker.
      The plug-in can then execute arbitrary code as the user running Deluge.
  Workaround :

    There is no known workaround at this time.

It was discovered that there was a cross-site request forgery vulnerability in the WebUI component of the 'deluge' Bittorrent client.

For Debian 7 'Wheezy', this issue has been fixed in deluge version 1.3.3-2+nmu1+deb7u1.

We recommend that you upgrade your deluge packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
100658	openSUSE Security Update : deluge (openSUSE-2017-656)	Nessus	SuSE Local Security Checks	critical
100278	Debian DSA-3856-1 : deluge - security update	Nessus	Debian Local Security Checks	critical
99013	GLSA-201703-06 : Deluge: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
97799	Debian DLA-863-1 : deluge security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-7178

high

Tenable Plugins

critical

critical

high

high