qBittorrent tries to access Favorites when theres an URL shortcut in the torrent (security concern)

[Destroyarr]

qBittorrent tries to access Favorites when theres an URL shortcut in the torrent (security concern)

[xavier2k6]

Related #19423 / #12518

[HanabishiRecca]

After some research I think that this indeed has something to do with how Windows handles URL files.
https://answers.microsoft.com/en-us/windows/forum/all/a-warning-popup-when-opening-any-url-file-in/8142f4b7-6678-4670-a59b-f01b89860dac
https://www.ghacks.net/2016/09/24/windows-favorites-file-download-security-warning/

Actual vulnerabilities in URL files already happened before.
https://swepstopia.com/url-file-attack/
https://inquest.net/blog/shortcut-to-malice-url-files/
https://blog.quarkslab.com/analysis-of-ms16-104-url-files-security-feature-bypass-cve-2016-3353.html

It's not clear what exactly happens here though. @Destroyarr, please provide a sample of the .url file.

I also found similar reports for completely unrelated apps.
https://www.tenforums.com/antivirus-firewalls-system-security/192166-controlled-folder-access-blocked-ie4uinit-exe.html.

[HanabishiRecca]

I have a wild guess that this happens when the client retrieves a file icon.

qBittorrent/src/gui/torrentcontentmodel.cpp

Lines 128 to 129 in 41d8f47

	const HRESULT hr = ::SHGetFileInfoW(extWStr.c_str(),
	FILE_ATTRIBUTE_NORMAL, &sfi, sizeof(sfi), (SHGFI_ICON | SHGFI_USEFILEATTRIBUTES));

[glassez]

@Destroyarr, please provide a sample of the .url file.

Torrent that distributes such .url file would be better.

[Destroyarr]

torrentgalaxy to/profile/FreeCourseWeb#torrents
tgx rs/torrents.php?c33=1

[Destroyarr]

magnet
:?xt=urn:btih:ff9b3c67f56018789780fee4e8e536a0b1cfb6bd&dn=Udemy%20-%20AI%20Application%20Boost%20with%20NVIDIA%20RAPIDS%20Acceleration