Nextcloud: Nextcloud Desktop Client RCE via malicious URI schemes

🗓️ 13 Jan 2021 17:29:19Reported by 7a69Type

Nextcloud Desktop Client RCE via malicious URI schemes. Utilizes QT's `QDesktopServices::openUrl()` to open URLs. Malicious server can serve a login website containing links with arbitrary URI schemes, which can lead to arbitrary code execution on various OS. Exploitable on Windows (e.g. by using `sftp://`), Linux (e.g. by using `sftp://nextclouduser@<server>/example.desktop` with empty password). Recommendation: Use strict allowlist to filter all URLs before passing them to `QDesktopServices::openURL()`

Reporter	Title	Published	Views	Family All 36
ATTACKERKB	CVE-2021-22879	14 Apr 202113:15	–	attackerkb
CNNVD	Nextcloud 注入漏洞	13 Apr 202100:00	–	cnnvd
CVE	CVE-2021-22879	14 Apr 202112:41	–	cve
Cvelist	CVE-2021-22879	14 Apr 202112:41	–	cvelist
Debian CVE	CVE-2021-22879	14 Apr 202112:41	–	debiancve
EUVD	EUVD-2021-10014	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 33 Update: nextcloud-client-3.1.3-1.fc33	24 Apr 202118:06	–	fedora
Tenable Nessus	GLSA-202105-37 : Nextcloud Desktop Client: User-assisted execution of arbitrary code	24 Jan 202200:00	–	nessus
Tenable Nessus	openSUSE Security Update : nextcloud-desktop (openSUSE-2021-577)	18 May 202100:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2021-22879	30 Aug 202500:00	–	nessus