UBUNTU-CVE-2017-7178: CSRF

Published Mar 18, 2017

Updated

CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.

Affected Software

1 affected component

ubuntu/deluge*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/deluge to a version that resolves this vulnerability.
Fixed in 1.3.12-1ubuntu1+esm1
Upgrade
Upgrade Deluge to a version that resolves this vulnerability.
Fixed in 1.3.14

Event History

Mar 18, 2017

CVE Published

via OSV·08:59 PM

Data Sourced

via OSV·08:59 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Deluge users are exposed?

Users of the Deluge web UI running a version before 1.3.14 are affected.

What must happen for exploitation to succeed?

An attacker must host a crafted plugin, and the victim must download, install, and enable that plugin. The plugin can execute an arbitrary program from its __init__.py file.

How can I determine whether a system is affected?

Check the installed Deluge version and whether the web UI is in use. Versions before 1.3.14 are affected.