cnvd - cnvd-2022-20701

cnvd-2022-20701

Vulnerability from cnvd

Title

Nextcloud输入验证错误漏洞（CNVD-2022-20701）

Description

Nextcloud是德国Nextcloud公司的一套开源的自托管文件同步和共享的通信应用平台。 Nextcloud Server中存在输入验证错误漏洞，该漏洞源于 DownloadResponse 没有对上传文件名做安全检查，攻击者可利用该漏洞诱导用户下载具有正常文件名的恶意文件。

Severity

中

Patch Name

Nextcloud输入验证错误漏洞（CNVD-2022-20701）的补丁

Patch Description

Nextcloud是德国Nextcloud公司的一套开源的自托管文件同步和共享的通信应用平台。 Nextcloud Server中存在输入验证错误漏洞，该漏洞源于 DownloadResponse 没有对上传文件名做安全检查，攻击者可利用该漏洞诱导用户下载具有正常文件名的恶意文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3hjp-26x8-mhf6

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-32679

Impacted products

Name
['Nextcloud Nextcloud Server <19.0.13', 'Nextcloud Nextcloud Server >=20.0.0，<20.0.11', 'Nextcloud Nextcloud Server >=21.0.0，<21.0.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-32679",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-32679"
    }
  },
  "description": "Nextcloud\u662f\u5fb7\u56fdNextcloud\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u81ea\u6258\u7ba1\u6587\u4ef6\u540c\u6b65\u548c\u5171\u4eab\u7684\u901a\u4fe1\u5e94\u7528\u5e73\u53f0\u3002\n\nNextcloud Server\u4e2d\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e DownloadResponse \u6ca1\u6709\u5bf9\u4e0a\u4f20\u6587\u4ef6\u540d\u505a\u5b89\u5168\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bf1\u5bfc\u7528\u6237\u4e0b\u8f7d\u5177\u6709\u6b63\u5e38\u6587\u4ef6\u540d\u7684\u6076\u610f\u6587\u4ef6\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/nextcloud/security-advisories/security/advisories/GHSA-3hjp-26x8-mhf6",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-20701",
  "openTime": "2022-03-18",
  "patchDescription": "Nextcloud\u662f\u5fb7\u56fdNextcloud\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u81ea\u6258\u7ba1\u6587\u4ef6\u540c\u6b65\u548c\u5171\u4eab\u7684\u901a\u4fe1\u5e94\u7528\u5e73\u53f0\u3002\r\n\r\nNextcloud Server\u4e2d\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e DownloadResponse \u6ca1\u6709\u5bf9\u4e0a\u4f20\u6587\u4ef6\u540d\u505a\u5b89\u5168\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bf1\u5bfc\u7528\u6237\u4e0b\u8f7d\u5177\u6709\u6b63\u5e38\u6587\u4ef6\u540d\u7684\u6076\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Nextcloud\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2022-20701\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Nextcloud Nextcloud  Server \u003c19.0.13",
      "Nextcloud Nextcloud Server \u003e=20.0.0\uff0c\u003c20.0.11",
      "Nextcloud Nextcloud Server \u003e=21.0.0\uff0c\u003c21.0.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-32679",
  "serverity": "\u4e2d",
  "submitTime": "2021-07-14",
  "title": "Nextcloud\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2022-20701\uff09"
}

CVE-2021-32679 (GCVE-0-2021-32679)

Vulnerability from cvelistv5

Published

2021-07-12 12:50

Modified

2024-08-03 23:25

Severity ?

3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-116 - Improper Encoding or Escaping of Output

Summary

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in controllers using `DownloadResponse`. When a user-supplied filename was passed unsanitized into a `DownloadResponse`, this could be used to trick users into downloading malicious files with a benign file extension. This would show in UI behaviours where Nextcloud applications would display a benign file extension (e.g. JPEG), but the file will actually be downloaded with an executable file extension. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. Administrators of Nextcloud instances do not have a workaround available, but developers of Nextcloud apps may manually escape the file name before passing it into `DownloadResponse`.

References

URL

Tags

	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3hjp-26x8-mhf6	x_refsource_CONFIRM
	https://github.com/nextcloud/server/pull/27354	x_refsource_MISC
	https://hackerone.com/reports/1215263	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202208-17	vendor-advisory, x_refsource_GENTOO