Lucene search

K
hackeroneCtulhuH1:1338781
HistorySep 13, 2021 - 7:57 p.m.

Nextcloud: User files is disclosed when someone called while the screen is locked

2021-09-1319:57:30
ctulhu
hackerone.com
27
nextcloud
data disclosure
security vulnerability
phone call
user privacy
bug bounty

EPSS

0.001

Percentile

22.1%

Summary:

User files in the server is disclosed while the screen is locked when someone called.

Steps To Reproduce:

[add details for how we can reproduce the issue]

1.) Make 2 Accounts, Lets call them Account A and Account B
2.) Using Account A login to (https://nextcloud/apps/spreed/)
3.) Using Account B login to NextCloud Talk App in your Phone and Lock the Screen
4.) Using Account A call Account B
5.) Using Account B accept the call and click the Message or SMS icon in the bottom left
6.) Attach a file and Press share from your nextcloud server
7.) You can see the user files

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

ā–ˆā–ˆā–ˆā–ˆ

Impact

A malicious attacker can see the user files by calling the phone while the screen is locked.

EPSS

0.001

Percentile

22.1%