Lucene search

K
hackeroneGeekysherlockH1:1222873
HistoryJun 10, 2021 - 1:52 p.m.

Nextcloud: Sensitive files/ data exists post deletion of user account

2021-06-1013:52:54
geekysherlock
hackerone.com
$150
51
nextcloud
sensitive data
android app
account deletion
user emails
tokens
information security
bug bounty

EPSS

0.001

Percentile

26.6%

In the latest android app ,I created an account in the name of [email protected].
After few activities,deleted the account .
Files containing user emails and tokens still exist.Relevant files not deleted upon deletion of account.

Content of files post deletion of account:
generic_x86:/data/data/com.nextcloud.client/shared_prefs # ls
FirebaseAppHeartBeat.xml WebViewChromiumPrefs.xml com.google.android.gms.appid.xml com.nextcloud.client_preferences.xml migrations.xml variant-emoji-manager.xml

generic_x86:/data/data/com.nextcloud.client/shared_prefs # cat com.nextcloud.client_preferences.xml
<?xml version=‘1.0’ encoding=‘utf-8’ standalone=‘yes’ ?>
<map>
<boolean name=“keysMigration” value=“true” />
<string name=“select_oc_account”>[email protected]@us.cloudamo.com</string>
<boolean name=“autoUploadPathUpdate” value=“true” />
<boolean name=“autoUploadInit” value=“true” />
<int name=“prefs_uploader_behaviour” value=“1” />
<boolean name=“storagePathFix” value=“true” />
<boolean name=“autoUploadEntriesSplitOut” value=“true” />
<boolean name=“keysReinit” value=“true” />
<string name=“pushToken”>euwTiu9CT3CvQNHqNVZPIk:APA91bHqkGjFhx-BiCEH_NcRnaEvrp21tbxvjOKhHrQ1mUTCW3Dp46X90YinSDcjfVXytTcT9CLQBcrOv5J_EfSGM7GbZrZAyeKC1xOtgNBLkFeo4_EqX7LqVW-ezuG_rou1y2Ux8ah5</string>
<float name=“grid_columns” value=“3.0” />
<string name=“storage_path”>/storage/emulated/0/Android/media/com.nextcloud.client</string>
<boolean name=“legacyClean” value=“true” />
<string name=“upload_from_local_last_path”>/storage/emulated/0/Pictures</string>
<int name=“lastSeenVersionCode” value=“30160190” />
</map>

Images folder
generic_x86:/data/data/com.nextcloud.client/shared_prefs # cd /storage/emulated/0/Pictures
generic_x86:/storage/emulated/0/Pictures # ls
2131099731.jpg 2131099732.jpg 2131099733.jpg

Impact

This information could be misused as sensitive token related ,images,user related details exist inspite of user account being deleted.

EPSS

0.001

Percentile

26.6%