Ratelimiting can be bypassed using IPv6 subnets

Description

Impact

Nextcloud server before v19.0.11, v20.0.10 and v21.0.2 did not consider IPv6 subnets in the ratelimiting implementation. This could potentially result in an attacker bypassing ratelimit controls such as the Nextcloud bruteforce protection.

Patches

It is recommended that the Nextcloud Server is upgraded to 19.0.11, 20.0.10 or 21.0.2.

Workarounds

Disable IPv6 access to the Nextcloud instance.

References

• HackerOne

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com