Concurrent Upload Denial of Service in OnionShare: CVE-2022-21689
Summary
CVE-2022-21689: OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affects onionshare across 2 version ranges.
< 2.2-3+deb11u1
< 6642c25959f14daeb4a572798ccf4acd765d5795
Fixed in 2.2-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OnionShare is an open-source tool designed for secure and anonymous file sharing, website hosting, and chat functionalities over the Tor network. It allows users to share files without revealing their identity, leveraging the privacy features of Tor. However, certain versions of OnionShare are vulnerable to a denial-of-service attack in receive mode, where an adversary can block file uploads for others by exploiting the upload limit.
Vulnerability Detail
The vulnerability arises from the receive mode of OnionShare, which limits concurrent uploads to 100 per second. If an adversary gains access to this mode, they can trigger a simple script to saturate the upload capacity, effectively blocking other users from uploading files. This issue is exacerbated by the anonymity properties of the Tor network, making it impossible to prevent such attacks in public mode. The potential ramifications include disruption of service for legitimate users and a significant impact on the usability of the application.
How To Fix
Minimum fixed version
2.2-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade onionshareTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate this vulnerability in public mode due to the inherent anonymity of the Tor network. Users are advised to limit access to the receive mode to trusted individuals only.
Conclusion
CVE-2022-21689 represents a significant vulnerability in OnionShare that can lead to denial-of-service attacks in its receive mode. Users are strongly encouraged to update to the latest versions to mitigate this risk. Given the nature of the Tor network, public mode users should be particularly cautious about access control.
See every vulnerability recorded for onionshare →
FAQ
CVE-2022-21689 is a vulnerability in OnionShare that allows an adversary to block file uploads for others by exploiting the upload limit in receive mode.
You can check if your installation is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The main consequence is a denial-of-service attack where legitimate users are unable to upload files, disrupting the intended functionality of OnionShare.
There is no way to prevent this attack in public mode due to the anonymity properties of the Tor network. Limiting access to trusted users is recommended.
The CVSS score for CVE-2022-21689 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for onionshare.
