Basic auth header on WebDAV requests is not brute-force protected

Description

Impact

Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address.

Patches

It is recommended that the Nextcloud Server is upgraded to 24.0.11, 25.0.5 or 26.0.0
It is recommended that the Nextcloud Enterprise Server is upgraded to 23.0.12.6, 24.0.11, 25.0.5 or 26.0.0

Workarounds

• No workaround available

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at portal.nextcloud.com