OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend
Date: 2022-01
Affected: pip/onionshare-cli
Attack vector: rce
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2022-21690
CVE-2022-21692
CWE: CWE-287
CWE-79
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test. - Vulnerability ID: OTF-001 - Vulnerability type: Improper Input Sanitization - Threat level: Elevated ## Description: The `path` parameter of the requested URL is not sanitized before being passed to the QT frontend. ## Technical description: The `path` parameter is not sanitized before being passed to the constructor of the `QLabel`. https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/desktop/src/onionshare/tab/mode/__init__.py#L499-L509 https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/desktop/src/onionshare/tab/mode/history.py#L456-L483 https://doc.qt.io/qt-5/qlabel.html#details > Warning: When passing a QString to the constructor or calling setText(), make sure to sanitize your input, as QLabel tries to guess whether it displays the text as plain text or as rich text, a subset of HTML 4 markup. You may want to call setTextFormat() explicitly, e.g. in case you expect the text to be in plain format but cannot control the text source (for instance when displaying data loaded from the Web). This path is used in all components for displaying the server access history. This leads to a rendered HT


Mitigations:

Architectural layers (MAESTRO):