Other nomination

CSRFing the uTorrent plugin

Rob

Chained CSRFs against uTorrent's local Web UI: setsetting points 'move completed downloads to' at the All Users Startup folder, then add-url makes uTorrent fetch an attacker torrent, so the payload lands where Windows runs it at boot. Settings are stored unescaped too, giving persistent XSS on getsettings; from localhost it runs in IE's Local Intranet zone, where WScript.Shell runs the file.

Record

Researcher

Rob

In the archive

• Nominated for the 2008 Top 10 Web Hacking Techniques

Tags

• csrf
• xss
• rce
• attack-chain
• activex
• javascript
• privilege-escalation
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Rob, first published at the original source. Preserved copies are kept so the citation survives its host.