Published: 15/01/2018 Updated: 03/10/2019

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 685

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Transmission up to and including 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote malicious users to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.

Vulnerable Product	Search on Vulmon	Subscribe to Product
transmissionbt transmission
debian debian linux 7.0
debian debian linux 8.0
debian debian linux 9.0

Debian Bug report logs - #886990 transmission: rpc session-id mechanism design flaw results in RCE Package: src:transmission; Maintainer for src:transmission is Sandro Tosi <morph@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 12 Jan 2018 10:21:01 UTC Severity: grave Tags: security, ups ...

Transmission could be made to run arbitraty code ...

Tavis Ormandy discovered a vulnerability in the Transmission BitTorrent client; insecure RPC handling between the Transmission daemon and the client interface(s) may result in the execution of arbitrary code if a user visits a malicious website while Transmission is running For the oldstable distribution (jessie), this problem has been fixed in ve ...

Transmission relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack (CVE-2018-5702) ...

The transmission-daemon in Transmission before 293 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack ...

The transmission bittorrent client uses a client/server architecture, the user interface is the client and a daemon runs in the background managing the downloading, seeding, etc Clients interact with the daemon using JSON RPC requests to a web server listening on port 9091 By default, the daemon will only accept requests from localhost A sampl ...

NVD-CWE-noinfo https://twitter.com/taviso/status/951526615145566208 https://github.com/transmission/transmission/pull/468 https://bugs.chromium.org/p/project-zero/issues/detail?id=1447 https://www.debian.org/security/2018/dsa-4087 https://www.exploit-db.com/exploits/43665/https://lists.debian.org/debian-lts-announce/2018/01/msg00020.html https://security.gentoo.org/glsa/201806-07 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=886990 https://usn.ubuntu.com/3533-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/43665/

CVE-2018-5702

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect