RCE (kind of) in Transmission BitTorrent’s daemon

If you run transmission-daemon, the somewhat popular (in small circles) Torrent client, any website you visit can talk to it, and execute arbitrary scripts/programs on your system. Oops! The GTK and Qt GUI apps share the same bug, but they don’t enable the functionality that is required to hit this bug (by default, at least). I think attacking Torrent clients (and servers!) is really interesting. You see, if I were a hired hacker/gun for Epstein for the Anti-Piracy industry, I’d be exploiting this ASAP and reaping the rewards. There’s also some cool prior art for messing with pirates at scale. Last year, someone bought the lapsed domain behind a long-dead tracker, pointed opentracker at it, and had around three million peers announcing to him within the hour. Popping a shell on those peers would certainly be.. fun. Anyways, the Transmission bug is kind of funny, because any webpage can just read the RPC session token out of a cross-origin response to the local HTTP service (aka: it…