PT-2022-15048 · Unknown · Onionshare

Micahflee · Published 2022-01-18 · Updated 2024-06-15 · CVE-2022-21696

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OnionShare versions 2.4 and earlier

Description OnionShare is an open source tool that lets users securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions, it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.

Recommendations For OnionShare version 2.4 and earlier, remove non-visible characters from the username to prevent impersonation. As a temporary workaround, consider restricting the rename feature to prevent users from adding whitespace characters to the end of their usernames. Restrict access to the chat environment to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-21696

GHSA-68VR-8F46-VC9F

OPENSUSE-SU-2024:11983-1

OPENSUSE-SU-2024:13635-1

PYSEC-2022-47

Affected Products

Onionshare

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21696.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-21696 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-21696 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68vr-8f46-vc9f · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13635-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21696 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21696 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21696 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11983-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21696 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21696 · Vendor Advisory
• https://github.com/onionshare/onionshare/releases/tag/v2.5 · Note
• https://github.com/onionshare/onionshare/security/advisories/GHSA-68vr-8f46-vc9f · Note
• https://github.com/onionshare/onionshare · Note