# Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSS

WebTorrent's torrent validation trusted Content-Disposition/Content-Type headers, letting a server serve a .bat as a .torrent and achieve client RCE.

- Payout: hidden
- Severity: medium
- Program: Brave Software
- Found by: d3f4u17
- Disclosed: 2022-06-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/963155
- Library page: https://bugbountylibrary.com/r/h1%3A963155
- Tags: area:os domain:browser domain:web impact:integrity impact:rce kind:bounty platform:hackerone sev:medium technique:chained vuln:file-upload vuln:rce vuln:xss

**Target:** WebTorrent download handler in Brave browser
**Root cause:** WebTorrent decides if a file is a torrent based on attacker-controlled Content-Disposition and Content-Type response headers rather than validating file content.
**Steps:**
1. Serve a PHP endpoint that returns torrent headers (`Content-Disposition: attachment; filename='PoC.torrent'`, `Content-Type: application/octet-stream`) when a Referer header is present.
2. On requests without Referer, return `Content-Disposition: attachment; filename='PoC.bat'` with `Content-Type: application/x-bat` and a malicious batch body.
3. Visit the page in Brave on Windows and click the link.
4. Choose 'Save .torrent file'; the browser saves the .bat payload.
5. Execute the saved file to run the batch (opens Notepad) demonstrating RCE.
**How found:** Researcher noticed WebTorrent's torrent detection relies on response headers, then crafted a server that varies headers by Referer to bypass validation and deliver a non-torrent executable.
**Exploitation:** Attacker hosts a page whose download response is a .bat disguised as a .torrent via spoofed headers; victim saves and runs it, executing arbitrary commands on Windows.
**Insight:** When a client classifies downloads by Content-Type/Content-Disposition, test whether varying request headers (Referer, UA) lets the same URL return a different, executable file type that the browser still saves under a trusted extension.