AB Download Manager - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/ab-download-manager/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 21:27:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAB Download Manager: Unauthenticated arbitrary file write via CSRF (CVE-2026-121451)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121451/Tue, 03 Nov 2026 21:27:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-121451/AB Download Manager versions prior to 1.11.2 are vulnerable to a cross-site request forgery attack allowing unauthenticated remote attackers to write arbitrary files to the filesystem, potentially facilitating remote code execution.AB Download Manager versions before 1.11.2 contain a cross-site request forgery (CSRF) vulnerability in the browser-integration API endpoint /start-headless-download. This vulnerability allows an unauthenticated attacker to write arbitrary files to locations on the user's system, including startup folders, to achieve code execution.

Attack Chain

  1. Attacker hosts a malicious webpage containing a cross-site request forgery (CSRF) payload.
  2. A targeted user with AB Download Manager installed navigates to the malicious webpage.
  3. The browser automatically sends a cross-site POST request to the local AB Download Manager API at /start-headless-download.
  4. The API processes the request due to the lack of CSRF protection.
  5. The attacker-controlled parameters ("folder" and "name") are used to write a file to an arbitrary path on the host filesystem.
  6. If a payload is written to a system startup directory, it executes upon the user's next login or reboot.

Recommendation

]]>highadvisory