HexBrain

Nextcloud · Report #2245437

App PIN code can be bypassed in Files iOS

Validstatus
lowseverity
$100bounty
33upvotes
18 Dec 2023disclosed

Summary

Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j8g7-88vv-rggv

How it was found

Hi Team,

Hope you are doing great.

Note: IoS APP Vs.: 4.9.1

I got a vulnerability in your applications via which an attacker is able to bypass the PIN. The attacker just need to bruteforce the 4 digit PIN as unlimited tries is accepted by the application, the attacker can simply do a bruteforce and access the application.

PoC: {F2844276}

Impact

Authentication Bypass leading to application access

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original