HexBrain

Nextcloud · Report #1067824

Database error shown to the user when using a long guest name in richdocuments

Validstatus
29upvotes
7 Feb 2021disclosed

How it was found

When sharing a file to a guest and the file is allow for editing, the user is asked to enter a guestname if you enter a really long value for that name you get a database error that displays sensitive information:

An exception occurred while executing 'INSERT INTO oc_richdocuments_wopi(fileid,owner_uid,version,canwrite,server_host,token,expiry,guest_displayname,template_destination,hide_download,direct,is_remote_token,template_id,share) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?)' with params [8606022, "8JaQyYP5xM7w2PJ6", 0, true, "https://demo2.nextcloud.com/", "hUYL4uh9Dals51BoAT2YA7WZ1IJMaCLp", 1609196332, "reallylongnameeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee (Guest)", 0, false, false, false, 0, "c4A53CW6wAN2ZZa"]: SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'guest_displayname' at row 1

Demo {F1133198}

Impact

Information Disclosure

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original