Multiple vulnerabilities in Nextcloud Guests

Published: 2024-01-19

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-22402 CVE-2024-22401
CWE-ID	CWE-177 CWE-841
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Guests Web applications / Modules and components for CMS
Vendor	Nextcloud

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper Handling of URL Encoding (Hex Encoding)

EUVDB-ID: #VU85602

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-22402

CWE-ID: CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper handling of request URLs in Guests app. A remote user can load the pages of apps they are not allowed to access.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Guests: 2.4.0 - 3.0.0

External links

http://github.com/nextcloud/security-advisories/security/advisories/GHSA-v3qw-7vgv-2fxj
http://github.com/nextcloud/guests/pull/1082
http://hackerone.com/reports/2251074

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Enforcement of Behavioral Workflow

EUVDB-ID: #VU85603

Risk: Low

CVSSv3.1: 3.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-22401

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow