SB2021081902 - Multiple vulnerabilities in Nextcloud Desktop Client

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Untrusted search path (CVE-ID: CVE-2021-37617)

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to uncontrolled search path. A remote attacker can create a malicious "Uninstall.exe" and execute it with administrative privileges on the target system.

2) Improper Certificate Validation (CVE-ID: CVE-2021-32728)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the client fails to check if a private key belongs to previously downloaded public certificate. A remote attacker can encrypt the data on the target system.

Remediation

Install update from vendor's website.

References

• https://github.com/nextcloud/desktop/pull/3497
• https://hackerone.com/reports/1240749
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q2w-v879-q24v
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f5fr-5gcv-6cc5
• https://github.com/nextcloud/desktop/pull/3338
• https://hackerone.com/reports/1189162