Lucene search

K
nextcloudNextcloudGHSA-5J2P-Q736-HW98
HistoryDec 18, 2023 - 8:27 a.m.

Bruteforce protection can be bypassed with misconfigured proxy

2023-12-1808:27:19
github.com
17
bruteforce protection
misconfigured proxy
nextcloud server
nextcloud enterprise server
reverse proxy
remote address
authentication attempts
vulnerability
nextcloud
hackerone
pullrequest

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

29.9%

Description

Impact

When a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended.

Patches

It is recommended that the Nextcloud Server is upgraded to 26.0.9 or 27.1.4
It is recommended that the Nextcloud Enterprise Server is upgraded to 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9 or 27.1.4

Workarounds

  • No workaround available

References

For more information

If you have any questions or comments about this advisory:

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

29.9%