HexBrain

Nextcloud · Report #1337422

Folder architecture and Filesizes of private file drop shares can be getten

Validstatus
mediumseverity
18upvotes
9 Apr 2022disclosed

How it was found

Steps To Reproduce:

  1. Create a new Folder "TestABC"
  2. Share a password protected link of this folder
  3. Create a file "README.md" and a file "README.md" in the Subfolder "Subfolder".

==> curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345"

==> curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345&folder=subfolder"

Impact

Folder architecture and Filesizes of private file drop shares can be getten

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original