Nextcloud · Report #2094473
Password of talk conversations can be bruteforced
Validstatus
mediumseverity
27upvotes
12 Nov 2023disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7rf8-pqmj-rpqv
How it was found
Steps To Reproduce:
- Instead of sending a POST to the authentication endpoint, the password can be added as a parameter on the GET request of the frontpage.
- A failure will not log a bruteforce attempt, but a successful password will no longer bring up the login page
Supporting Material/References:
Found while looking into https://support.nextcloud.com/#ticket/zoom/47814
Impact
Brute force protection of public talk conversation passwords can be bypassed.