HexBrain

Nextcloud · Report #1652903

Exception logging in Sharepoint app reveals clear-text connection details

Validstatus
mediumseverity
4upvotes
26 Nov 2022disclosed

Summary

Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpf5-jj85-36h5

How it was found

Summary:

On Exceptions thrown in the context of the SharePoint app, connection credentials may be written to the Nextcloud log in clear text.

Steps To Reproduce:

Attempt to configure a sharepoint mount in an erroneous way.

Supporting Material/References:

Impact

When an attacker gets hold of the nextcloud log, they may gain knowledge of credentials to connect to a SharePoint service.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original