Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

Summary

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

Remediation

1. Inventory every transmission transmission deployment, including staging.
2. Upgrade transmission transmission to 4.1.3.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e
• Patchhttps://github.com/transmission/transmission/pull/8938
• Advisoryhttps://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit
• Advisoryhttps://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token
• Referencehttps://github.com/transmission/transmission
• Referencehttps://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560
• Referencehttps://github.com/transmission/transmission/releases/tag/4.1.3