CVE-2019-13640 Command injection in n/a

Critical 9.8 Published 17 Jul 2019 Updated 31 Oct 2024

Attackers can execute arbitrary commands via shell metacharacters in torrent names or tracker parameters, affecting qBittorrent users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-13640?

CVE-2019-13640 is a critical command injection vulnerability in n/a, published on 17 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.

Weakness: CWE-78

Which versions are affected by CVE-2019-13640?

It affects 1 product.

Linux distribution packages (2)

`qbittorrent` SUSE:Package Hub 15 SP1	All versions	`4.1.5-bp151.3.3.1`
`qbittorrent` openSUSE:Leap 15.1	All versions	`4.1.5-lp151.2.3.1`

Products include Qbittorrent Qbittorrent.

How do I fix CVE-2019-13640?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-13640 being exploited?

There is no known exploitation of CVE-2019-13640 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2019-13640, DSA-4650-1, GHSA-mjwm-xp4r-6444, MGASA-2019-0379, UBUNTU-CVE-2019-13640, openSUSE-SU-2019:2005-1 and 1 more.