HexBrain

Nextcloud · Report #1167767

Unexpected federated shares added via public link

Informativestatus
mediumseverity
7upvotes
26 Apr 2021disclosed

How it was found

So I'm not 100% sure if this is an security issue or not. But it is in my opinion at least unexpected and could be handled better to make sure people trust the system.

  1. Get a public link share (again plenty of those around)
  2. Click the 'add to your Nextcloud'
  3. A federated share is added/created

However now the owner of the public link at 1 has a new federated share added. Without any idea where it comes from. Which would be reason for concern in my book. Esp for people that do not know about the functionality etc.

Impact

Missing descriptions or notifications can limit the trust in the system. Esp for regular users without technical knowledge on how things work. I'd expect a notification. Or at the very least a description in the sharing tab (? is that the correct name?) for the federated share 'mounted from public link X'

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original