PT-2022-15040 · Unknown+2 · Onionshare+2

Micahflee · Published 2022-01-18 · Updated 2025-07-08 · CVE-2022-21689

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OnionShare versions 2.4

Description The receive mode in OnionShare limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script. An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network. A penetration test conducted between September 26, 2021, and October 8, 2021, demonstrated this vulnerability using a script that sent around 6000 requests in parallel, blocking file upload on a public receive instance.

Recommendations

• Remove the limitation of 100 concurrent uploads per second.
• Derive directory name from milliseconds to prevent the creation of more than 100 directories per second. As a temporary workaround, consider restricting access to the receive mode to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-21689

GHSA-JH82-C5JW-PXPC

PYSEC-2022-40

USN-7625-1

Affected Products

Linuxmint

Onionshare

Ubuntu

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21689.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-21689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21689 · Security Note
• https://ubuntu.com/security/CVE-2018-19960 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7625-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21689 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jh82-c5jw-pxpc · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-21689 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21689 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-40 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21689 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7625-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21689 · Security Note
• https://github.com/onionshare/onionshare/releases/tag/v2.5 · Note
• https://github.com/onionshare/onionshare/security/advisories/GHSA-jh82-c5jw-pxpc · Note