GHSA-w9m4-7w72-r766

Suggest an improvement
Source
https://github.com/advisories/GHSA-w9m4-7w72-r766
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-w9m4-7w72-r766/GHSA-w9m4-7w72-r766.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-w9m4-7w72-r766
Aliases
Published
2022-01-21T23:20:22Z
Modified
2024-10-07T21:46:40.381934Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Improper Access Control in Onionshare
Details

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test.

  • Vulnerability ID: OTF-004
  • Vulnerability type: Improper Access Control
  • Threat level: Moderate

Description:

Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.

Technical description:

otf-004-a otf-004-b otf-004-c

This series of screenshots show Alice, Bob and Eve joined a chatroom and are the only participants in the chatroom. Eve seemingly leaves the chatroom, which leads Bob and Alice to believe they are having a private chat. The last screenshot shows that Eve only emitted the leave message and is still able to read the chat and possibly write messages.

This can be reproduced by joining the chat with two different instances, where one instance has slightly modified the client-side JavaScript code similar to OTF-003 (page 22). The joined emit needs to be removed from the connect event handler. Therefore the modified client is not listed in the userlist and has no active session. The modified non-listed user also needs to change their username to Eve, which is not shown in the chatroom. The modified client then emits the disconnect event and their connection is no longer usable.

This results in the leave message for Eve and the removal from the user-list but not in removal of the original session of the Eve who announced to join the chat.

Impact:

An adversary with access to the chat environment can spoof his leave event but still persist in the chat with access to all sent messages and the possibility to write in the chat using OTF-003 (page 22).

Recommendation:

  • Implement proper session handling
Database specific
{
    "nvd_published_at": "2022-01-18T22:15:00Z",
    "cwe_ids": [
        "CWE-306"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-19T19:04:59Z"
}
References

Affected packages

PyPI / onionshare-cli

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3
Fixed
2.5

Affected versions

2.*

2.3
2.3.1
2.3.2
2.3.3