# [Brave browser] WebTorrent has DNS rebinding vulnerability

Brave's WebTorrent local HTTP server ignored Host header, letting a malicious site DNS-rebind to enumerate and read downloaded torrent files.

- Payout: hidden
- Severity: low
- Program: Brave Software
- Found by: newfunction
- Disclosed: 2019-10-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/663729
- Library page: https://bugbountylibrary.com/r/h1%3A663729
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:low technique:recon vuln:info-disclosure vuln:misconfiguration

**Target:** WebTorrent extension's local HTTP file server
**Root cause:** The local HTTP server serving downloaded torrent files on a random port does not validate the Host header, so requests arriving via a rebindable attacker domain are served normally.
**Steps:**
1. Download `poc.html`; in Fiddler AutoResponder match `regex:http://example.org:\d+/test.html` and respond with `poc.html`
2. Add `127.0.0.1  example.org` to hosts file
3. In Brave, open a magnet link and start the torrent; after download completes, hover the Save file icon to note URL like `http://127.0.0.1:50210/0`
4. Navigate to `http://example.org:50210/test.html` and click Start testing
5. Observe the first downloaded file's content rendered on the page
**How found:** Noticed the WebTorrent extension serves downloaded files over a local HTTP server on a random port and hypothesized it lacks Host header validation, enabling DNS rebinding.
**Exploitation:** Attacker page performs port scanning then DNS rebinding so its own hostname resolves to 127.0.0.1, then issues same-origin requests to the WebTorrent local server to read downloaded file contents.
**Insight:** Local helper servers on random ports are still reachable via DNS rebinding; test Host-header validation on any localhost file/media server shipped inside a browser or app.