Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
13 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise untrusted symlinks, a remote recipient with access to the OnionShare service can read arbitrary local files readable by the OnionShare process that the symlink points to. This affects the shipped onionshare-cli Python package and the desktop application because both call the same onionsharecli.web file-indexing and streaming code. Details Tested repository: https://github.com/onionshare/onionshare at commit 8cc75e1d7e88bd31f7276733449d412bf71c8999. Affected product evidence: - cli/pyproject.toml declares onionsharecli version 2.6.3. - desktop/pyproject.toml declares onionshare version 2.6.3 and depends on onionsharecli from ../cli. - cli/setup.py publishes onionshare-cli and includes…
Recommended action: Upgrade to 2.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint (--disable-files / "Disable uploading files"), a remote sender who can reach the OnionShare service can still send a crafted multipart request containing file[]; OnionShare writes the uploaded bytes to disk before the route handler skips file accounting. This affects the shipped onionshare-cli Python package and the desktop application because both use the same onionsharecli.web.receivemode request-streaming implementation. Details Tested repository: https://github.com/onionshare/onionshare at commit 8cc75e1d7e88bd31f7276733449d412bf71c8999. Affected product evidence: - cli/pyproject.toml declares onionsharecli version 2.6.3. - desktop/pyproject.toml declares onionshare version 2.6.3 and depends on onionsharecli from ../cli. - cli/setup.py publishes onionshare-cli and includes onionsharecli.web plus…
Recommended action: Upgrade to 2.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-014 - Vulnerability type: Out-of-bounds Read - Threat level: Elevated Description: The desktop application was found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing. Technical description: Prerequisites: - Onion address is known - Public service or authentication is valid - Desktop application is used - History is displayed The rendering of images found in OTF-001 (page 25) could be elevated to a Denial of Service, which requires only very few bytes to be sent as a path parameter to any of the Onionshare functions. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. - Vulnerability ID: OTF-012 - Vulnerability type: Denial of Service - Threat level: Moderate Description: The receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script. Technical description: The following script uses GNU parallel and curl with around 6000 requests in parallel to send 10000 requests. A change in the ulimit -n configuration is required for it to work. This is sufficient to block file upload on a (public) receive instance. Attack duration was around 80 seconds. Cases where over 99 requests were sent per second: Cases where files were successfully written to disk: This means that during the attack time 1601 requests of 10000 were dropped. We tried to upload multiple files in the web interface during the attack and…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-001 - Vulnerability type: Improper Input Sanitization - Threat level: Elevated Description: The path parameter of the requested URL is not sanitized before being passed to the QT frontend. Technical description: The path parameter is not sanitized before being passed to the constructor of the QLabel. https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/desktop/src/onionshare/tab/mode/init.py#L499-L509 https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/desktop/src/onionshare/tab/mode/history.py#L456-L483 https://doc.qt.io/qt-5/qlabel.html#details Warning: When passing a QString to the constructor or calling setText(), make sure to sanitize your input, as QLabel tries to guess…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-004 - Vulnerability type: Improper Access Control - Threat level: Moderate Description: Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom. Technical description: This series of screenshots show Alice, Bob and Eve joined a chatroom and are the only participants in the chatroom. Eve seemingly leaves the chatroom, which leads Bob and Alice to believe they are having a private chat. The last screenshot shows that Eve only emitted the leave message and is still able to read the chat and possibly write messages. This can be reproduced by joining the chat with two different instances, where one instance has slightly modified the client-side JavaScript code similar to OTF-003 (page 22). The joined…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-003 - Vulnerability type: Improper Access Control - Threat level: Moderate Description: Anyone with access to the chat environment can write messages disguised as another chat participant. Technical description: Prerequisites: - Alice and Bob are legitimate users - A third user has access to the chat environment This screenshot shows Alice (glimpse-depress) and Bob (blinker-doorpost) joined a chatroom and are the only participants in the chatroom. Then the non-listed user squad-nursing writes a message in the chatroom without being visible in the list of users. The sending of the message itself is not required but was done here to show the initial access. The non-listed participant now renames himself to Bob and writes another message, seemingly…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-013 - Vulnerability type: Improper Hardening - Threat level: Low Description: The filesystem restriction could be hardened and should only allow for pre-defined subfolders. Technical description: The Flatpak and Snap configurations allow for read-only access on the whole home folder. The relevant lines in the configuration files are onionshare/snap/snapcraft.yaml#L20 and onionshare/flatpak/org.onionshare.OnionShare.yaml#L19 , respectively. The encapsulation of filesystem access via these mechanisms should be restricted to pre-defined folders and not allow for access to (configuration) files outside the Onionshare-specific folders. Sadly Snap does not allow for further restriction to specific folders and therefore cannot be further hardened. By…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-006 - Vulnerability type: Broken Website Hardening Control - Threat level: Low Description: The CSP can be turned on or off but not configured for the specific needs of the website. Technical description: The website mode of the application allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images. If CSP were configurable, the website creator could harden it accordingly to the needs of the application. As this issue correlates with the Github issue for exposing the flask application directly (https://github.com/onionshare/…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-009 - Vulnerability type: Improper Access Control - Threat level: Low Description: Authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. Technical description: Prerequisites: - Existing chatroom - Access to the chatroom (Public or known Private Key) - Either a modified frontend client or manual requests from burp/curl If a user opens the chatroom without emitting the join message he will not be present in session.users[x] list. Therefore there is no listing in the frontend and no chat participant knows another party joined the chat. It is still possible to send messages in the chatroom. If a user decides to abuse OTF-003 (page 22) he can impersonate messages from existing…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-005 - Vulnerability type: Improper Input Sanitization - Threat level: Low Description: It is possible to change the username to that of another chat participant with an additional space character at the end of the name string. Technical description: Assumed users in Chat: - Alice - Bob - Mallory 1. Mallory renames to Alice . 2. Mallory sends message as Alice . 3. Alice and Bob receive a message from Mallory disguised as Alice , which is hard to distinguish from the Alice in the web interface. Other (invisible) whitespace characters were found to be working as well. Impact: An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.…
Recommended action: Upgrade to 2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.
Recommended action: Upgrade to 2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
Recommended action: Upgrade to 2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.