OnionShare 2.6.3 Symlink Following Vulnerability Advisory and Fix

Vulnerability Overview In OnionShare CLI Desktop version 2.6.3, a vulnerability exists that allows users to inadvertently leak local files via symbolic links (symlinks) within shared directories. This vulnerability affects both the package and the desktop application, as they both utilize the same file reading and streaming code located in . Scope of Impact Affected Version: 2.6.3 Fixed Version: 2.6.4 Severity: Medium (4.8/10) Attack Vector: Network Attack Complexity: High Required Privileges: Low User Interaction: Required Impact Scope: Unchanged Confidentiality: High Integrity: None Availability: None Remediation 1. Reject Symbolic Links: Immediately reject symbolic links when building the file mapping, and enforce canonical paths before opening/streaming/packaging files. 2. Track Root Directory: Track the selected root directory as a canonical value, and ensure that the resolved paths of all served paths remain within one of these root directories. 3. Re-validate Paths: Re-validate resolved paths prior to calling and / to handle unexpected cases related to . 4. Add Regression Tests: - Website mode service root-level symbolic links - Website mode service nested symbolic links - Sharing default ZIP files containing symbolic links to a single selected folder - Sharing single file symbolic link downloads using - Existing recursive ZIP symbolic link skip behavior POC Code Observed Output Negative Control Cases Requesting in website mode returns HTTP 404 and does not contain , proving this is not a generic path traversal or test hazard artifact. Recursive ZIP traversal offers partial mitigation within , but this mitigation has been bypassed via root-level single-folder expansion and direct file streaming. Cleanup The POC deletes the temporary directory, and the audit run prints after executing . Impact Recipients of a remote OnionShare share or website service can access files located outside the selected shared directory if that directory contains symbolic links pointing to readable local files. This could lead to the leakage of SSH keys, browser profiles, wallet files, documents, or other sensitive files accessible by the OnionShare process. The most realistic attack scenario involves a malicious archive/project/report provided to an OnionShare user, containing symbolic link paths. If the user extracts or obtains the directory and its contents, the recipient can request the symbolic link path through website mode, single-file share mode, or by retrieving the root-level symbolic link within a single folder in the default shared ZIP. This issue is particularly surprising because one ZIP code path already attempted to recursively skip symbolic links, indicating that dereferencing symbolic links beyond the shared directory is an unexpected behavior. Credit Thai Son Dinh from VinSOC Labs (R&D)

Goal Reached Thanks to every supporter — we hit 100%!

OnionShare 2.6.3 Symlink Following Vulnerability Advisory and Fix

More from this source