Multiple vulnerabilities in Nextcloud Server

1) Authorization bypass through user-controlled key

EUVDB-ID: #VU53819

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32654

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper authorization. A remote attacker can receive write/read privileges on any Federated File Share.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Nextcloud Server: 19.0.0 - 21.0.1

External links

http://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5
http://hackerone.com/reports/1170024

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU53827

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32653

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Nextcloud Server sends user IDs to the lookup server even if the user has no fields set to published. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Nextcloud Server: 19.0.0 - 21.0.1

External links

http://hackerone.com/reports/1173436
http://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU53828

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32657

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote authenticated attacker can break the user administration page.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Nextcloud Server: 19.0.0 - 21.0.1

External links

http://hackerone.com/reports/1147611
http://github.com/nextcloud/security-advisories/security/advisories/GHSA-fx62-q47f-f665

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Handling of Unexpected Data Type

EUVDB-ID: #VU53829

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32655

CWE-ID: CWE-241 - Improper Handling of Unexpected Data Type

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the files drop public link can be added as federated share. A remote attacker can convert a files drop link to a federated share, leading to an issue on the UI side of the sharing user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Nextcloud Server: 19.0.0 - 21.0.1

External links

http://hackerone.com/reports/1167929
http://github.com/nextcloud/security-advisories/security/advisories/GHSA-grph-cm44-p3jv

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper access control

EUVDB-ID: #VU53830

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-32656

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the trusted servers exchange can be triggered by attacker. A remote attacker can trigger this exchange if they have access to a public link and gain access to basic user information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Nextcloud Server: 19.0.0 - 21.0.1

External links

http://hackerone.com/reports/1167853
http://github.com/nextcloud/security-advisories/security/advisories/GHSA-j875-vr2q-h6x6

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.