Nextcloud · Report #2067572
New AppPassword can be generated without password confirmation
Validstatus
highseverity
$250bounty
11upvotes
10 Aug 2023disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j4qm-5q5x-54m5
How it was found
There is protection on https://github.com/nextcloud/server/blob/master/apps/settings/lib/Controller/AuthSettingsController.php#L122 that you must have recently entered your password to be able to generate a new AppPassword. However if an attacker would obtain access to your system (say you forgot to lock it when taking a quick bathroom break).
They can abuse a route to just obtain this. https://SERVER/ocs/v2.php/core/getapppassword
Probably without you ever noticing.
Impact
The password confirmation to generate an app password is effectively useless as it is trivial to bypass.