Improper verification of cryptographic signature in desktop - CVE-2023-29000

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to desktop client does not verify received signed certificate in the end-to-end encryption. A remote attacker with control over a malicious server can trick the application into encrypting files with a key known to the attacker.

Affected software

How to mitigate CVE-2023-29000

External References

• https://github.com/nextcloud/desktop/pull/4949
• https://hackerone.com/reports/1679267
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h82x-98q3-7534

Related Security Bulletins

• Improper verification of cryptographic signature in Nextcloud Desktop client