Login Sign Up

CVE-2021-41868

9.8 CRITICAL
Authentication Bypass

📋 TL;DR

CVE-2021-41868 is a critical vulnerability in OnionShare that allows unauthenticated remote attackers to upload files to non-public receive nodes. This affects all users running OnionShare 2.3 versions before 2.4 with the --receive functionality enabled. The vulnerability bypasses intended access controls and could lead to unauthorized file uploads.

💻 Affected Systems

Products:
  • OnionShare
Versions: 2.3 to 2.3.3 (all versions before 2.4)
Operating Systems: All platforms running OnionShare
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects instances using the --receive functionality. Standard OnionShare sharing nodes are not affected.

📦 What is this software?

Onionshare by Onionshare

View all CVEs affecting Onionshare →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could upload malicious files, execute arbitrary code, compromise the host system, or use the node for unauthorized data exfiltration.

🟠

Likely Case

Unauthorized file uploads leading to potential malware distribution, data corruption, or denial of service through disk space exhaustion.

🟢

If Mitigated

Limited impact if proper network segmentation and access controls prevent external access to vulnerable instances.

🌐 Internet-Facing: HIGH - The vulnerability is remotely exploitable without authentication and affects internet-facing OnionShare instances.
🏢 Internal Only: MEDIUM - Internal instances could still be exploited by internal threat actors or compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

The vulnerability is simple to exploit - attackers can send HTTP POST requests to upload endpoints without authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4 and later

Vendor Advisory: https://github.com/onionshare/onionshare/releases/tag/v2.4

Restart Required: Yes

Instructions:

1. Stop all OnionShare instances. 2. Update to OnionShare 2.4 or later. 3. Restart OnionShare services.

🔧 Temporary Workarounds

Disable Receive Functionality

all

Temporarily disable the --receive functionality until patching is possible.

Do not use 'onionshare --receive' command

Network Access Control

linux

Restrict network access to OnionShare instances using firewalls or network segmentation.

iptables -A INPUT -p tcp --dport 17600 -j DROP
ufw deny 17600

🧯 If You Can't Patch

  • Isolate vulnerable instances in separate network segments with strict firewall rules
  • Implement application-level monitoring for unauthorized file upload attempts

🔍 How to Verify

Check if Vulnerable:

Check OnionShare version: if version is 2.3.x and less than 2.4, and --receive functionality is used, the system is vulnerable.

Check Version:

onionshare --version

Verify Fix Applied:

Verify OnionShare version is 2.4 or later and test that unauthenticated file uploads to receive nodes are properly rejected.

📡 Detection & Monitoring

Log Indicators:

  • Unauthorized POST requests to /upload endpoint
  • File uploads from unexpected IP addresses
  • Failed authentication attempts on receive nodes

Network Indicators:

  • HTTP POST requests to OnionShare receive nodes from external IPs
  • Unusual file upload patterns to OnionShare ports

SIEM Query:

source="onionshare.log" AND ("POST /upload" OR "unauthorized upload")

📊 Metadata

CVE ID: CVE-2021-41868
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: October 4, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON