SB2020082723 - Multiple vulnerabilities in Nextcloud Desktop client

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2020-8189)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear

The vulnerability allows a remote authenticated user to read and manipulate data.

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.

2) Path traversal (CVE-ID: CVE-2020-8227)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote privileged user to execute arbitrary code.

Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.

Remediation

Install update from vendor's website.

References

• https://hackerone.com/reports/685552
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-027
• https://hackerone.com/reports/590319
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-032