SB2021090705 - Multiple vulnerabilities in Nextcloud Richdocuments

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: CVE-2021-37628)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed. A remote attacker can read arbitrary files in such a share.

2) Improper control of interaction frequency (CVE-ID: CVE-2021-37629)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to a lack of ratelimiting on the Richdocuments OCS endpoint. A remote attacker can enumerate potentially valid share tokens.

Remediation

Install update from vendor's website.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxhh-954f-8w7w/
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gvvr-h36p-8mjx/