Description
AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| amir1376 | ab-download-manager | < 1.11.2 | 1.11.2 |
References
- GitHub Issue #1489 issue-tracking
- https://github.com/amir1376/ab-download-manager product
- Fix commit patch
- https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75 technical-description
- https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88 technical-description
- VulnCheck Advisory: AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF third-party-advisory