Nextcloud · Report #222667
Possible SSRF in email server settings(SMTP mode)
How it was found
Description:
vul address https://demo.nextcloud.com/xxx/settings/admin/additional,when you change smtp server address ,you will get some different hints.
Reproduce steps:
1.Go to https://demo.nextcloud.com/xxx/settings/admin/additional,choose SMTP mode
2.Set server address to "172.17.1.0`,then you will get screenshot(nextcloud1.png),it means not on the same network segment
3.Set server address to "172.17.0.0`,then you will get screenshot(nextcloud2.png),it means the address not exists or doesn't open any port to access
4.Set server address to "172.17.0.1` and port to empty,then the test email will send successfully! it means this host exists and opens a smtp port
5.Set server address to "172.17.0.1and port to22`,then you will get screenshot(nextcloud3.png),it means the address exists,but can not access to the port