Arbitrary file download due to bad handling of Redirects in WebTorrent

How it was found

Summary:

Previously I reported #963155 how an attacker can trick user into downloading malicious files using ".save torrent" feature, In this report I am going to reproduce the same behavior but by abusing a different feature.

Description

While I was testing webtorrent on brave I noticed that whenever webtorrent detects a torrent file a request is made to the following extension scheme

chrome-extension://lgjmpdmojkpocjcopdikifhejkkjglho/extension/brave_webtorrent.html?{torrent_url/magnet_link}

WebTorrent also consider a URL a valid torrent file if a URI starts with a magnet: scheme or if it ends with a .torrent extension for example:-

chrome-extension://lgjmpdmojkpocjcopdikifhejkkjglho/extension/brave_webtorrent.html?http://xyz.com?x=.torrent
chrome-extension://lgjmpdmojkpocjcopdikifhejkkjglho/extension/brave_webtorrent.html?magnet%3Ablahblah

Both the above URIs will be considered as a valid torrent file by WebTorrent (Refer below SS).

{F977576}

Another behavior that I observed was, when opening a URL http://xyz.com?x=.torrent will serve a normal response but one can force it to be opened with WebTorrent using the extensions scheme chrome-extension://lgjmpdmojkpocjcopdikifhejkkjglho/extension/brave_webtorrent.html?http://xyz.com?x=.torrent

Also, if a website for example, http://xyz.com redirects to http://abc.com then one can interrupt the redirection and can force it to open the source site via webtorrent before the redirection takes place. This behavior can be leveraged by an attacker to redirect a user to a malicious website or can force user to download a malicious file onto their system (for more better understanding please refer the Steps-to-Reproduce section) .

Tested on

• Brave Version 1.12.114 Chromium: 84.0.4147.135 (Windows)

Steps To Reproduce:

• Visit https://php-demo-app-shibli.cfapps.io/brave/brave-poc.html
• Click on "Save .torrent file" option
• "Poison.bat" file will be downloaded onto your machine

An attacker can also use this to redirect the user to a malicious webpage. See below POC video

{F977593}

Impact

Remote Code Execution Remote JavaScript execution Installing malware on client's machine Phishing