User scoped external storage can be used to gather credentials of other users

Description

Impact

A user could use this functionality to get access to the login credentials of another user and take over their account.

Patches

It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2
It is recommended that the Nextcloud Enterprise Server is upgraded to 19.0.13.9, 20.0.14.14, 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7 or 26.0.2

Workarounds

3 Workarounds are available:

• Disable app files_external
• Change config setting “Allow users to mount external storage” to disabled in “Administration” > “External storage” settings …/index.php/settings/admin/externalstorages
• Change config setting to disallow users to create external storages in “Administration” > “External storage” settings …/index.php/settings/admin/externalstorages with the following types:
  • FTP
  • Nextcloud
  • SFTP
  • WebDAV

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at portal.nextcloud.com