# Arbitrary file download due to bad handling of Redirects in WebTorrent

Brave's WebTorrent extension treats any URL ending in .torrent as a torrent, letting a redirecting page force download of an arbitrary malicious file.

- Payout: hidden
- Severity: medium
- Program: Brave Software
- Found by: d3f4u17
- Disclosed: 2022-06-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/975514
- Library page: https://bugbountylibrary.com/r/h1%3A975514
- Tags: area:os domain:browser impact:integrity impact:rce kind:bounty platform:hackerone sev:medium technique:chained vuln:file-upload vuln:open-redirect

**Target:** Brave WebTorrent extension (brave_webtorrent.html)
**Root cause:** WebTorrent extension accepts any URL ending in .torrent or magnet: scheme as a valid torrent and loads it via the chrome-extension scheme, without validating the actual content or handling redirects safely.
**Steps:**
1. Host a page that redirects to a URL ending in `.torrent` (e.g. `http://xyz.com?x=.torrent`)
2. Load `chrome-extension://lgjmpdmojkpocjcopdikifhejkkjglho/extension/brave_webtorrent.html?http://xyz.com?x=.torrent`
3. Interrupt the redirect before it completes so WebTorrent fetches the source URL
4. WebTorrent downloads the served file (e.g. `Poison.bat`) to the user's machine
**How found:** Researcher noticed WebTorrent treats URLs ending in .torrent or magnet: as valid torrents and that redirects could be interrupted to force the extension to fetch the source URL before redirection.
**Exploitation:** Attacker lures victim to a page that triggers the WebTorrent extension scheme with a redirecting URL; the extension fetches the URL and saves the returned file (malicious .bat) to disk, or redirects the user to a malicious webpage.
**Escalation:** Chained with redirect interruption to bypass the normal navigation and force file download, leading to RCE/malware install.
**Insight:** Custom protocol/extension handlers that sniff URLs by suffix (.torrent) or scheme can be abused via redirects to fetch attacker-controlled content; test whether the handler validates actual file content versus URL string.