Trusted servers exchange can be triggered by attacker

Description

Impact

Nextcloud supports sharing of the registered users with other Nextcloud servers. Nextcloud supports adding these automated when selecting the “Add server automatically once a federated share was created successfully” setting.

As a public link can be added as federated share, an attacker can trigger this exchange if they have access to a public link. Thus getting access to basic user information.

Patches

It is recommended that the Nextcloud Server is upgraded to 19.0.11, 20.0.10 or 21.0.2

Workarounds

Disable “Add server automatically once a federated share was created successfully” in the Nextcloud settings.

References

• HackerOne

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com