Dear Maintainer,

Upstream has fixed a security issue in qBittorrent's dynamic DNS
functionality that is still present in Debian trixie's 5.1.0-2
package.

The public IP address is obtained from http://checkip.dyndns.org over
unencrypted HTTP. When dynamic DNS is enabled, an attacker able to
modify this response can supply an attacker-controlled IP address.
qBittorrent then uses the user's stored credentials to submit that
address to the configured DDNS provider, redirecting the hostname to
the attacker's infrastructure. Returning a stale address can also
suppress legitimate updates.

The HTTP request is present in src/base/net/dnsupdater.cpp in Debian's
5.1.0 source archive, and the patches shipped in 5.1.0-2 do not change
it. The same issue is present in bookworm's 4.5.2-3+deb12u1 package.

Upstream PR #24805 switches IP discovery to HTTPS and also blocks
redirects from HTTPS to insecure protocols by default in the shared
download manager. The fix is included in upstream 5.3.0.

References:

Upstream report and fix, PR #24805

Debian 5.1.0 original source

Debian 5.1.0-2 packaging and patches

Could you assess this issue for security tracking and backporting to
the affected supported Debian releases?

This report is based on the upstream disclosure and source inspection;
I have not reproduced an attack.

Kind regards,
Jonatan Nyberg