CVE-2022-21689 Denial of Service in Onionshare

What is CVE-2022-21689?

CVE-2022-21689 is a high-severity denial of service vulnerability in onionshare, published on 18 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions the receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script. An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network.

Weakness: CWE-400

Which versions are affected by CVE-2022-21689?

3 open source packages ship an affected version, including onionshare-cli. It affects 1 product.

Products include Onionshare Onionshare.

How do I fix CVE-2022-21689?

Upgrade onionshare-cli to 2.5 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-21689 being exploited?

There is no known exploitation of CVE-2022-21689 in the wild and no public exploit code.

Other vulnerabilities in onionshare

• CVE-2021-41868 Remote unauthenticated attackers able to upload files in Onionshare Critical 9.8
• CVE-2022-21690 Cross-Site Scripting in Onionshare High 8.7
• CVE-2022-21688 Out-of-bounds Read in Onionshare High 7.5
• CVE-2018-19960 Path traversal in n/a High 7.0
• CVE-2022-21693 Path traversal in Onionshare Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-21689, GHSA-jh82-c5jw-pxpc, PYSEC-2022-40, UBUNTU-CVE-2022-21689.