URI Argument Injection in BTCGPU-Qt

We recently found and confirmed that BTCGPU Core in the **latest release ** (version 0.17.3) and earlier versions are affected by a remote code execution vulnerability in Qt5-based GUI apps. Specifically, the QApplication in Qt framework used by the BTCGPU GUI Program will parse Qt built-in arguments, such as -reverse and -platformpluginpath (see the document here).

For example, when you start the bitcoin-qt.exe program in command line and then append a built-in argument, such as -reverse, e.g., "C:\Program Files BitcoinGold\bitcoin-qt.exe" bitcoin:address -reverse, you will get a reverse BTCGPU GUI.

For more details, you may also refer to the following pages.

• The vulnerable code in BTCGPU: src/qt/bitcoin.cpp, see line 285 to 292.
• Similar fix from Bitcoin: PR#16578.
• The original CVE-2021-3401 report
• The exploited details.

Reported by de957ad9679f28a38f02f00cc7928bce8fb424882ff060a3c09c32895b1474cc.

Attachment