CVE-2022-21690 Cross-Site Scripting in Onionshare

What is CVE-2022-21690?

CVE-2022-21690 is a high-severity cross-site scripting vulnerability in onionshare, published on 18 Jan 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components for displaying the server access history. This leads to a rendered HTML4 Subset (QT RichText editor) in the Onionshare frontend.

Weakness: CWE-79

Which versions are affected by CVE-2022-21690?

3 open source packages ship an affected version, including onionshare-cli. It affects 1 product.

Products include Onionshare Onionshare.

How do I fix CVE-2022-21690?

Upgrade onionshare-cli to 2.5 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-21690 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-21690 exists.

Other vulnerabilities in onionshare

• CVE-2021-41868 Remote unauthenticated attackers able to upload files in Onionshare Critical 9.8
• CVE-2022-21688 Out-of-bounds Read in Onionshare High 7.5
• CVE-2022-21689 Denial of Service in Onionshare High 7.5
• CVE-2018-19960 Path traversal in n/a High 7.0
• CVE-2022-21693 Path traversal in Onionshare Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-21690, GHSA-ch22-x2v3-v6vq, PYSEC-2022-41.