Skip to content
OpenAdvisories
Unscored Public exploit CVE-2017-7178 EUVD-2017-16216GHSA-xp26-fwf6-j3gx

CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes…

Published Mar 18, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: deluge Package: deluge Ecosystem: Debian Ecosystem: Ubuntu

Description

CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its __init__.py file and (2) causing the victim to download, install, and enable this plugin.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 deluge 1.3.13+git20161130.48cedf63-2 —
Debian 13 deluge 1.3.13+git20161130.48cedf63-2 —
Debian 12 deluge 1.3.13+git20161130.48cedf63-2 —
Debian 8 deluge 1.3.10-3+deb8u1 DSA-3856-1
Debian 7 deluge 1.3.3-2+nmu1+deb7u1 DLA-863-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS deluge 1.3.12-1ubuntu1+esm1 USN-8979-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 3

References