HexBrain

Nextcloud · Report #225098

SQL exception in JSON format

Validstatus
lowseverity
6upvotes
31 Jan 2020disclosed

How it was found

Hi, I know this is not critical, just a design issue, but it will be better if it will not show up to the user as an error, maybe in log files readable to the www-user or to the root user in order to debug.

PoC:

  1. Create a user and confirm the password
  2. Capture the packet
  3. Replay the packet with a username bigger than 64 words in length two times in order to duplicate the user.
  4. Receiving error.

This is working only when the input for the username is bigger than 64 words. (65 needed.)

Example:

Request - POST http://172.16.1.68/nextcloud/index.php/settings/users/users HTTP/1.1 DATA: username=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&password=test123A

Response -

{"message":"An exception occurred while executing 'INSERT INTO `oc_users` ( `uid`, `password` ) VALUES( ?, ? )' with params [\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\", \"1|$2y$10$gwzH19jqn8HveRpCb2haNurF7rycqsZeYYS7b1zPENnUInUyP35J2\"]:\n\nSQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' for key 'PRIMARY'"}

Example:

Request - POST http://172.16.1.68/nextcloud/index.php/settings/users/users HTTP/1.1 DATA: username=aaaaaaa&password=test123A

Response -

{"message":"A user with that name already exists."}

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original