Nextcloud · Report #1200815
Federated share accepting/declining is not logged in audit log
Validstatus
lowseverity
12upvotes
3 Sept 2022disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x
How it was found
In relation to https://hackerone.com/reports/1177353
- Enable the audit log
- Share a file to a federated user
- So far all looks good in the log
- the recipient checks either accepts or declines the share
- There is no line regarding this in the logs.
Impact
The audit log is used to get a full trail of the actions which is now incompletely. With possible important information. It seems to be also listed on https://portal.nextcloud.com/article/using-the-audit-log-44.html From my point of view a declined share is unshared again.