Nextcloud · Report #2112973
Enabling Birthday Contact to any user
Validstatus
mediumseverity
29upvotes
21 Nov 2023disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8jwv-c8c8-9fr3
How it was found
Summary:
Was able to enable Birthday Contacts any User, Admin, SuperAdmin. from a low privileged user.
Steps To Reproduce:
- Navigate to Calendar.
- At the very bottom find calendar settings
- Click on
Enable Birthday Contacts - Intercept the following request
POST /remote.php/dav/calendars/{userId}
<x3:enable-birthday-calendar xmlns:x3="http://nextcloud.com/ns"/>
Impact
Users with low privileges enable the "Birthday Contacts" feature for any user, including Admins and SuperAdmins, within the Nextcloud application. By following a simple set of steps, an attacker could navigate to the Calendar section, access the calendar settings, enable the "Birthday Contacts" feature, and intercept a specific request to achieve this unauthorized action.