A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1068-1 advisory.

  - A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store     unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with     those rules. (CVE-2020-8293)

  - A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored     XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format. (CVE-2020-8294)

  - A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when     resetting the password for a user. (CVE-2020-8295)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11,     and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller     (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications     on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other     Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds     aside from upgrading are known to exist. (CVE-2021-32678)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11,     and 21.0.3, filenames where not escaped by default in controllers using `DownloadResponse`. When a user-     supplied filename was passed unsanitized into a `DownloadResponse`, this could be used to trick users into     downloading malicious files with a benign file extension. This would show in UI behaviours where Nextcloud     applications would display a benign file extension (e.g. JPEG), but the file will actually be downloaded     with an executable file extension. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3.
    Administrators of Nextcloud instances do not have a workaround available, but developers of Nextcloud apps     may manually escape the file name before passing it into `DownloadResponse`. (CVE-2021-32679)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11,     and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting     of a share expiration date. This event is supposed to be logged. This issue is patched in versions     19.0.13, 20.0.11, and 21.0.3. (CVE-2021-32680)

  - Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application     specific tokens for authentication purposes. These tokens are supposed to be granted to a specific     applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem     access. Due to a lacking permission check, the tokens were able to change their own permissions in     versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant     themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There     are no known workarounds aside from upgrading. (CVE-2021-32688)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011,     and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker     to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3.
    There are no known workarounds. (CVE-2021-32703)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011,     and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker     to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13,     20.0.11, and 21.0.3. There are no known workarounds. (CVE-2021-32705)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011,     and 21.0.3, default share permissions were not being respected for federated reshares of files and     folders. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
    (CVE-2021-32725)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011,     and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier     used username, the previous user could gain access to their account. The issue was fixed in versions     19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. (CVE-2021-32726)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011,     and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception     messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in     versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in     Nextcloud Server app settings. (CVE-2021-32734)

  - Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011,     and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have     allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13,     20.0.11, and 21.0.3. There are no known workarounds. (CVE-2021-32741)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for nextcloud fixes the following issues :

  - nextcloud was upgraded to version 20.0.7

  - CVE-2020-8294: Fixed a missing link validation     (boo#1181803)

  - CVE-2020-8295: Fixed a denial of service attack     (boo#1181804)

  - CVE-2020-8293: Fixed an input validation issue     (boo#1181445)

ID	Name	Product	Family	Severity
151853	openSUSE 15 Security Update : nextcloud (openSUSE-SU-2021:1068-1)	Nessus	SuSE Local Security Checks	critical
146325	openSUSE Security Update : nextcloud (openSUSE-2021-262)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-8293

medium

Tenable Plugins

critical

medium