Micahflee

**Name of the Vulnerable Software and Affected Versions** OnionShare versions prior to 2.5 **Description** OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affected versions of the desktop application were found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. **Recommendations** Update to version 2.5 to resolve the issue. As a temporary workaround, consider disabling the rendering of images in the history tab until a patch is available. Monitor for upstream fix and apply it when available.

**Name of the Vulnerable Software and Affected Versions** OnionShare versions 2.4 **Description** The receive mode in OnionShare limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script. An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network. A penetration test conducted between September 26, 2021, and October 8, 2021, demonstrated this vulnerability using a script that sent around 6000 requests in parallel, blocking file upload on a public receive instance. **Recommendations** - Remove the limitation of 100 concurrent uploads per second. - Derive directory name from milliseconds to prevent the creation of more than 100 directories per second. As a temporary workaround, consider restricting access to the receive mode to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OnionShare versions 2.4 and earlier **Description** The path parameter of the requested URL is not sanitized before being passed to the QT frontend, leading to a rendered HTML4 Subset in the Onionshare frontend. This issue affects the display of server access history in all components. An adversary with knowledge of the Onion service address can render arbitrary HTML in the server desktop application, requiring the desktop application with rendered history. The impact is elevated. **Recommendations** For OnionShare version 2.4 and earlier: Manually define the text format of the QLabel via `setTextFormat()`. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OnionShare versions prior to 2.5 **Description** The issue allows chat participants to spoof their channel leave message, tricking others into assuming they left the chatroom. This can be exploited by an adversary with access to the chat environment, enabling them to persist in the chat with access to all sent messages and the possibility to write in the chat. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** Implement proper session handling to prevent chat participants from spoofing their channel leave message. As a temporary workaround, consider monitoring chatroom activity closely to detect potential spoofing attempts until a patch is available. Restrict access to the chat environment to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OnionShare versions prior to the fixed version **Description** OnionShare is an open source tool that lets users securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions, anyone with access to the chat environment can write messages disguised as another chat participant. This issue is due to improper access control, allowing an adversary to impersonate existing chat participants and write messages, but not read the conversation. **Recommendations** - Implement proper session handling to prevent unauthorized access to the chat environment. - As a temporary workaround, consider restricting access to the chat environment until a patch is available. - Avoid using the `update username` function to choose an existing username from the chat until the issue is resolved. - Restrict modification of the `chat.js` script in the browser's internal debugger to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OnionShare (affected versions not specified) **Description** OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions, an adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced. **Recommendations** - Reduce read access in Flatpak configuration. - Use the flatpak release to mitigate the issue. - Restrict access to sensitive files in the user home folder until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OnionShare (affected versions not specified) **Description** The website mode of OnionShare allows the use of a hardened Content Security Policy (CSP), which blocks scripts and external resources. However, this CSP cannot be configured for individual pages, making it unusable for websites that require JavaScript or external resources like fonts or images. This issue is considered a general weakness rather than a direct vulnerability, with a low threat level. **Recommendations** - Consider offering a configurable webserver choice - Consider configurable CSP At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OnionShare versions prior to 2.5 **Description** OnionShare is an open source tool that lets users securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions, authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue allows an adversary with access to the chat environment to send messages to the chat without being visible in the list of chat participants. **Recommendations** For OnionShare versions prior to 2.5: Update to version 2.5 to resolve the issue. As a temporary workaround, consider implementing proper session handling and allowing chat access only after emission of the join event. Restrict access to the chat environment to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OnionShare versions 2.4 and earlier **Description** OnionShare is an open source tool that lets users securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions, it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username. **Recommendations** For OnionShare version 2.4 and earlier, remove non-visible characters from the username to prevent impersonation. As a temporary workaround, consider restricting the rename feature to prevent users from adding whitespace characters to the end of their usernames. Restrict access to the chat environment to minimize the risk of exploitation.