Nextcloud · Report #145950

Uploading files to a folder where invited user don't have any EDIT privilege

Validstatus

10upvotes

19 Jul 2016disclosed

Summary

The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.

A detailed advisory can be found at https://nextcloud.com/security/advisory/?id=nc-sa-2016-004.

Thanks a lot, @detroitsmash for pointing out this vulnerability!

How it was found

Hi,

Any invited user to a shared folder with no edit privilege can create files in it through copy feature of Nextclod android app.

Steps to reproduce it

Create any folder and invite a user in it without any edit privilege.
Now login from invited user account through android app.
Copy any file from your nextcloud root folder to shared folder.
Check nextcloud web app!! Copied file will show in shared folder

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original