PT-2022-15045 · Unknown · Onionshare

Micahflee · Published 2022-01-18 · Updated 2024-06-15 · CVE-2022-21693

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OnionShare (affected versions not specified)

Description OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions, an adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced.

Recommendations

• Reduce read access in Flatpak configuration.
• Use the flatpak release to mitigate the issue.
• Restrict access to sensitive files in the user home folder until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-21693

GHSA-JGM9-XPFJ-4FQ6

OPENSUSE-SU-2024:11983-1

OPENSUSE-SU-2024:13635-1

PYSEC-2022-44

Affected Products

Onionshare

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21693.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-21693 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-21693 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21693 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jgm9-xpfj-4fq6 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13635-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21693 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21693 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21693 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21693 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-44 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11983-1 · Vendor Advisory
• https://github.com/onionshare/onionshare/releases/tag/v2.5 · Note
• https://github.com/onionshare/onionshare/security/advisories/GHSA-jgm9-xpfj-4fq6 · Note
• https://github.com/onionshare/onionshare · Note