HexBrain

Nextcloud · Report #222667

Possible SSRF in email server settings(SMTP mode)

Informativestatus
mediumseverity
2upvotes
15 May 2017disclosed

How it was found

Description: vul address https://demo.nextcloud.com/xxx/settings/admin/additional,when you change smtp server address ,you will get some different hints.

Reproduce steps:

1.Go to https://demo.nextcloud.com/xxx/settings/admin/additional,choose SMTP mode

2.Set server address to "172.17.1.0`,then you will get screenshot(nextcloud1.png),it means not on the same network segment

3.Set server address to "172.17.0.0`,then you will get screenshot(nextcloud2.png),it means the address not exists or doesn't open any port to access

4.Set server address to "172.17.0.1` and port to empty,then the test email will send successfully! it means this host exists and opens a smtp port

5.Set server address to "172.17.0.1and port to22`,then you will get screenshot(nextcloud3.png),it means the address exists,but can not access to the port

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original