SB2021071213 - Multiple vulnerabilities in Nextcloud Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021071213

SB2021071213 - Multiple vulnerabilities in Nextcloud Server

Published: July 12, 2021

Security Bulletin ID SB2021071213
Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 86% Low 14%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2021-32733)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Text application. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


2) Improper control of interaction frequency (CVE-ID: CVE-2021-32703)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to a lack of ratelimiting on the shareinfo endpoint. A remote attacker can enumerate potentially valid share tokens.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-32725)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to default share permissions are not respected for federated reshares of files and folders, which leads to security restrictions bypass and privilege escalation.


4) Information disclosure (CVE-ID: CVE-2021-32734)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Nextcloud Text application shipped with Nextcloud server did return verbatim exception messages to the user. A remote attacker can gain unauthorized access to sensitive information on the system.


5) Incorrect Ownership Assignment (CVE-ID: CVE-2021-32726)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to the Webauthn tokens are not deleted after a user has been deleted. If a victim reuse an earlier used username, the previous user can gain access to their account.


6) Improper control of interaction frequency (CVE-ID: CVE-2021-32741)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to a lack of ratelimiting on the public share link mount endpoint. A remote attacker can enumerate potentially valid share tokens.


7) Improper control of interaction frequency (CVE-ID: CVE-2021-32705)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to a lack of ratelimiting on the public DAV endpoint. A remote attacker can enumerate potentially valid share tokens or credentials.


Remediation

Install update from vendor's website.

References