CVE-2024-40624: TorrentPier Deserialization of Untrusted Data vulnerability
Summary
CVE-2024-40624: TorrentPier Deserialization of Untrusted Data vulnerability. Affects torrentpier/torrentpier versions < 2.4.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TorrentPier is an open-source package available on Packagist that provides functionality for managing and sharing torrent files. It is commonly used in online communities and forums. The package allows users to browse and interact with torrent files, including viewing forums and downloading files. However, a vulnerability has been discovered in the package that allows for the deserialization of untrusted data, potentially leading to remote code execution and command execution on the system.
Vulnerability Detail
The vulnerability in TorrentPier exists in the get_tracks() function in the torrentpier/library/includes/functions.php file. This function uses the unsafe native PHP serialization format to deserialize user-controlled cookies. An attacker can exploit this by crafting a malicious cookie, such as the bb_t cookie, which will be deserialized when a user visits the viewforum.php page. By leveraging this vulnerability, an attacker can execute arbitrary PHP code on the system, leading to potential remote code execution and command execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the deserialization of user-controlled cookies in the get_tracks() function. This can be achieved by modifying the code to use a safer deserialization method, such as JSON deserialization, or by implementing input validation and sanitization to ensure that only trusted data is deserialized. Here is an example of how the code can be modified:
diff --git a/torrentpier/library/includes/functions.php b/torrentpier/library/includes/functions.php
index 84f6c9f..a1b2c3d 100644
--- a/torrentpier/library/includes/functions.php
+++ b/torrentpier/library/includes/functions.php
@@ -41,7 +41,7 @@ function get_tracks()
{
global $bb_cfg;
- $bb_t = unserialize($_COOKIE['bb_t']);
+ $bb_t = json_decode($_COOKIE['bb_t'], true);
if (!is_array($bb_t))
{
Conclusion
The TorrentPier package is vulnerable to a deserialization vulnerability that allows for the execution of arbitrary PHP code. To mitigate this issue, users should update their installations to version 2.4.4 or later, which includes a fix for this vulnerability. In the meantime, users can apply a temporary workaround by modifying the code to disable the deserialization of user-controlled cookies. It is important to stay updated on security advisories and apply patches promptly to ensure the security of your application.
See every vulnerability recorded for torrentpier/torrentpier →
FAQ
TorrentPier is an open-source package available on Packagist that provides functionality for managing and sharing torrent files. It is commonly used in online communities and forums.
This vulnerability allows an attacker to execute arbitrary PHP code on the system, potentially leading to remote code execution and command execution.
To fix this vulnerability, it is recommended to update the TorrentPier package to version 2.4.4 or later, which includes a patch for this issue.
As a temporary workaround, users can disable the deserialization of user-controlled cookies in the get_tracks() function by modifying the code to use a safer deserialization method or implementing input validation and sanitization.
You can find more information about this vulnerability in the GitHub Security Advisory database: [link to vulnerability details]
References
Related vulnerabilities
Recent vulnerabilities recorded for torrentpier/torrentpier.
