Description
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Novik | ruTorrent | < 5.3.20 | 5.3.20 |
References
- GitHub Issue #3474 issue-tracking
- https://github.com/Novik/ruTorrent product
- Fix commit patch
- https://github.com/Novik/ruTorrent/blob/v5.3.19/plugins/datadir/action.php#L60 technical-description
- https://github.com/Novik/ruTorrent/blob/v5.3.19/php/settings.php#L526-L541 technical-description
- VulnCheck Advisory: ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following third-party-advisory