| Package | Affected versions | Patched versions |
|---|---|---|
| onionshare-cli | ≥ 2.3, < 2.5< 2.5 | 2.5 |
| onionshare | < 2.5 | 2.5 |
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test.
Authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants.
Prerequisites:
If a user opens the chatroom without emitting the join message he will not be present in session.users[x] list. Therefore there is no listing in the frontend and no chat participant knows another party joined the chat. It is still possible to send messages in the chatroom.
If a user decides to abuse OTF-003 (page 22) he can impersonate messages from existing users; others would not be able to distinguish original and faked messages. This is also a prerequisite for OTF-004 (page 19).
An adversary with access to the chat environment can send messages to the chat without being visible in the list of chat participants.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free