Jump to content

[Important security related] Disable Web UI listening on default port


John Peterson

Recommended Posts

Certainly doesn't when I enable the alternative port. You probably have corrupted settings, or you've encountered a bug (which I doubt, considering I've tested various versions to confirm this). Or your browser is relying too heavily on its cache.

Link to comment
Share on other sites

>curl -v -uadmin:1234567890 http://localhost:1234/gui/ -o test01.txt
* About to connect() to localhost port 1234 (#0)
* Trying 127.0.0.1...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0*
connected
* Connected to localhost (127.0.0.1) port 1234 (#0)
* Server auth using Basic with user 'admin'
> GET /gui/ HTTP/1.1
> Authorization: Basic YWRtaW46MTIzNDU2Nzg5MA==
> User-Agent: curl/7.25.0 (i386-pc-win32) libcurl/7.25.0 OpenSSL/0.9.8u zlib/1.2
.6 libssh2/1.4.0
> Host: localhost:1234
> Accept: */*
>
< HTTP/1.1 200 OK
< Connection: keep-alive
< Content-Length: 39932
< Content-Type: text/html
< ETag: "01CC7606C6DD039A"
< Set-Cookie: GUID=Qdbbjp5KfbBvphY37bSc; path=/
<
{ [data not shown]
100 39932 100 39932 0 0 311k 0 --:--:-- --:--:-- --:--:-- 419k
* Connection #0 to host localhost left intact
* Closing connection #0

>curl -v -uadmin:1234567890 http://localhost:12345/gui/ -o test02.txt
* About to connect() to localhost port 12345 (#0)
* Trying 127.0.0.1...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0*
connected
* Connected to localhost (127.0.0.1) port 12345 (#0)
* Server auth using Basic with user 'admin'
> GET /gui/ HTTP/1.1
> Authorization: Basic YWRtaW46MTIzNDU2Nzg5MA==
> User-Agent: curl/7.25.0 (i386-pc-win32) libcurl/7.25.0 OpenSSL/0.9.8u zlib/1.2
.6 libssh2/1.4.0
> Host: localhost:12345
> Accept: */*
>
< HTTP/1.1 400 ERROR
< Connection: keep-alive
< Content-Length: 17
< Content-Type: text/html
<
{ [data not shown]
100 17 100 17 0 0 182 0 --:--:-- --:--:-- --:--:-- 274
* Connection #0 to host localhost left intact
* Closing connection #0

Same setup.

Link to comment
Share on other sites

Nevermind, turns out I didn't test exactly as you did. I see that second serial request on the same connection seems to cause µTorrent to respond with data. Looks more like a bug report than a feature request to me.

>curl -v -uadmin:1234567890 http://localhost:12345/gui/ -o test02.txt htt
p://localhost:12345/gui/ -o test03.txt
* About to connect() to localhost port 12345 (#0)
* Trying 127.0.0.1...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0*
connected
* Connected to localhost (127.0.0.1) port 12345 (#0)
* Server auth using Basic with user 'admin'
> GET /gui/ HTTP/1.1
> Authorization: Basic YWRtaW46MTIzNDU2Nzg5MA==
> User-Agent: curl/7.25.0 (i386-pc-win32) libcurl/7.25.0 OpenSSL/0.9.8u zlib/1.2
.6 libssh2/1.4.0
> Host: localhost:12345
> Accept: */*
>
< HTTP/1.1 400 ERROR
< Connection: keep-alive
< Content-Length: 17
< Content-Type: text/html
<
{ [data not shown]
100 17 100 17 0 0 180 0 --:--:-- --:--:-- --:--:-- 269
* Connection #0 to host localhost left intact
* Re-using existing connection! (#0) with host (nil)
* Connected to (nil) (127.0.0.1) port 12345 (#0)
* Server auth using Basic with user 'admin'
> GET /gui/ HTTP/1.1
> Authorization: Basic YWRtaW46MTIzNDU2Nzg5MA==
> User-Agent: curl/7.25.0 (i386-pc-win32) libcurl/7.25.0 OpenSSL/0.9.8u zlib/1.2
.6 libssh2/1.4.0
> Host: localhost:12345
> Accept: */*
>
< HTTP/1.1 200 OK
< Connection: keep-alive
< Content-Length: 39932
< Content-Type: text/html
< ETag: "01CC7606C6DD039A"
< Set-Cookie: GUID=EVwk1GGRFkp59NGArCdW; path=/
<
{ [data not shown]
100 39932 100 39932 0 0 829k 0 --:--:-- --:--:-- --:--:-- 829k
* Connection #0 to host (nil) left intact
* Closing connection #0

Moved to Bug Reports forum.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...