PT-2022-15043 · Unknown · Onionshare

Micahflee · Published 2022-01-18 · Updated 2024-06-15 · CVE-2022-21691

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OnionShare versions prior to 2.5

Description The issue allows chat participants to spoof their channel leave message, tricking others into assuming they left the chatroom. This can be exploited by an adversary with access to the chat environment, enabling them to persist in the chat with access to all sent messages and the possibility to write in the chat. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations Implement proper session handling to prevent chat participants from spoofing their channel leave message. As a temporary workaround, consider monitoring chatroom activity closely to detect potential spoofing attempts until a patch is available. Restrict access to the chat environment to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-21691

GHSA-W9M4-7W72-R766

OPENSUSE-SU-2024:11983-1

OPENSUSE-SU-2024:13635-1

PYSEC-2022-42

Affected Products

Onionshare

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21691.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21691 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w9m4-7w72-r766 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13635-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21691 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21691 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21691 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21691 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-21691 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11983-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-42 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21691 · Vendor Advisory
• https://github.com/onionshare/onionshare/releases/tag/v2.5 · Note
• https://github.com/onionshare/onionshare/security/advisories/GHSA-w9m4-7w72-r766 · Note
• https://github.com/onionshare/onionshare · Note