SB2021090705 - Multiple vulnerabilities in Nextcloud Richdocuments

Description

This security bulletin contains information about 2 vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: CVE-2021-37628)

CWE-ID: -

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed. A remote attacker can read arbitrary files in such a share.

2) Improper control of interaction frequency (CVE-ID: CVE-2021-37629)

CWE-ID: CWE-799 - Improper Control of Interaction Frequency

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to a lack of ratelimiting on the Richdocuments OCS endpoint. A remote attacker can enumerate potentially valid share tokens.

Remediation

Install update from vendor's website.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxhh-954f-8w7w/
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gvvr-h36p-8mjx/