Executive brief
WebTorrent is a popular JavaScript library for downloading and sharing files via the BitTorrent protocol. When a WebTorrent server displays a torrent's file list on its index page, specially crafted file or torrent names can inject malicious JavaScript that runs in a user's browser, potentially allowing attackers to learn what content is being downloaded or steal other sensitive data.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) in the HTTP server component of WebTorrent versions before 0.107.6. When torrent.createServer() creates an HTTP server and a user visits the index page, torrent titles and file names are rendered without HTML sanitization. An attacker can craft a torrent with a malicious file name containing JavaScript payloads (e.g., <img src=x onerror="...">) that executes in the browser context of anyone viewing the index page. The attack requires user interaction (visiting the server's index page). The impact is limited because the HTTP server only allows fetching torrent data pieces; an attacker cannot control the WebTorrent client itself. The vulnerability was fixed in version 0.107.6 by HTML-escaping untrusted torrent metadata.
Affected products
- WebTorrent webtorrent before 0.107.6
Timeline
- 2019-09-04: disclosed: Vulnerability published in GHSA database
- 2019-08-27: patched: Fix merged in PR #1714; version 0.107.6 released with fix