Nextcloud · Report #388515
Access control issue -- [Allow file system access not validated when using session auth]
Validstatus
mediumseverity
$100bounty
17upvotes
25 Sept 2018disclosed
Summary
- Obtain an App Token
- Check that you can access the files with this token and save the cookies
- Revoke filesystem access for this token
- See that you can still access the files when using the cookies
At step 4 there access to the files should also be forbidden.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.