qBittorrent fixes bug that left users vulnerable to MitM attacks for 14 years

---

qBittorrent fixes bug that left users vulnerable to MitM attacks for 14 years#### qBittorrent, a BitTorrent file-sharing application, has fixed a remote code execution vulnerability caused by an SSL/TLS certificate authentication failure in the DownloadManager component. This vulnerability has been present in the application since 2010 and was finally fixed in the latest version 5.0.1, released on 28 October 2024.

The main problem was that qBittorrent had been accepting any certificate since 2010, including fake/illegitimate ones, which allowed attackers in a man-in-the-middle (MitM) position to manipulate data on the network.

Security researcher Sharp Security identifies four main risks from this situation. qBittorrent prompts users to install Python via a fixed URL if Python is not available on Windows. Due to the lack of certificate authentication, an attacker could replace the URL with a malicious version of the Python installer.

In addition, qBittorrent checks for updates by downloading the XML feed from a fixed URL. Without a valid SSL certificate, an attacker could replace the update link in the XML feed with a malicious link. The Download Manager in qBittorrent is also used for RSS feeds, allowing attackers to modify the content of the RSS feed and insert malicious URLs posing as secure torrent links.

Finally, qBittorrent automatically downloads and decompresses the compressed GeoIP database, allowing you to exploit potential memory overflow bugs via files from a fake server.

The latest version of qBittorrent 5.0.1 already addresses these risks, so users are advised to upgrade as soon as possible.