Ab Download Manager
Monthly
Arbitrary file write in AB Download Manager before 1.11.2 allows a malicious web page to place attacker-chosen files at any path the desktop application can write, including per-user autostart locations, by posting crafted folder and name values to the /start-headless-download endpoint of its local browser-integration HTTP server. Exploitation is unauthenticated (PR:N) but requires user interaction: the victim must load the attacker's page in a browser on the same host while the integration server is running, since the pre-patch default leaves that API without enforced API-key authentication. The consequence is code execution at the next user login or reboot, when the dropped payload is launched from the startup folder; no public exploit code was identified at time of analysis, and the vendor has released 1.11.2 together with an upstream commit that splits the Ktor routes into auth-optional and auth-required groups and adds an apiKeyEnforced setting.
Arbitrary file write in AB Download Manager before 1.11.2 allows a malicious web page to place attacker-chosen files at any path the desktop application can write, including per-user autostart locations, by posting crafted folder and name values to the /start-headless-download endpoint of its local browser-integration HTTP server. Exploitation is unauthenticated (PR:N) but requires user interaction: the victim must load the attacker's page in a browser on the same host while the integration server is running, since the pre-patch default leaves that API without enforced API-key authentication. The consequence is code execution at the next user login or reboot, when the dropped payload is launched from the startup folder; no public exploit code was identified at time of analysis, and the vendor has released 1.11.2 together with an upstream commit that splits the Ktor routes into auth-optional and auth-required groups and adds an apiKeyEnforced setting.