Nextcloud · Report #1652903
Exception logging in Sharepoint app reveals clear-text connection details
Validstatus
mediumseverity
4upvotes
26 Nov 2022disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpf5-jj85-36h5
How it was found
Summary:
On Exceptions thrown in the context of the SharePoint app, connection credentials may be written to the Nextcloud log in clear text.
Steps To Reproduce:
Attempt to configure a sharepoint mount in an erroneous way.
Supporting Material/References:
- was files publically: https://github.com/nextcloud/sharepoint/issues/141
Impact
When an attacker gets hold of the nextcloud log, they may gain knowledge of credentials to connect to a SharePoint service.