Nextcloud Server Information Disclosure Vulnerability (GHSA-495w-cqv6-wr59)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:nextcloud:nextcloud_server";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.125574");
  script_version("2025-12-11T05:46:19+0000");
  script_tag(name:"last_modification", value:"2025-12-11 05:46:19 +0000 (Thu, 11 Dec 2025)");
  script_tag(name:"creation_date", value:"2025-12-09 08:08:40 +0000 (Tue, 09 Dec 2025)");
  script_tag(name:"cvss_base", value:"6.1");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:M/C:C/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-12-10 16:12:34 +0000 (Wed, 10 Dec 2025)");

  script_cve_id("CVE-2025-66510");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Nextcloud Server Information Disclosure Vulnerability (GHSA-495w-cqv6-wr59)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_nextcloud_server_http_detect.nasl");
  script_mandatory_keys("nextcloud/server/detected");

  script_tag(name:"summary", value:"Nextcloud Server is prone to an information disclosure
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Contacts search allowed to retrieve personal data of other users
  (emails, names, identifiers) without proper access control. This allows an authenticated user to
  retrieve information about accounts that are not related or added as contacts.");

  script_tag(name:"affected", value:"Nextcloud Server prior to version 28.0.14.11, 29.0.0
  prior to 29.0.16.8, 30.0.0 prior to 30.0.17.3, 31.0.0 prior to 31.0.10 and 32.0.0 prior to 32.0.1.");

  script_tag(name:"solution", value:"Update to version 28.0.14.11, 29.0.16.8, 30.0.17.3, 31.0.10,
  32.0.1 or later.");

  script_xref(name:"URL", value:"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "28.0.14.11")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "28.0.14.11", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "29.0.0", test_version_up: "29.0.16.8")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "29.0.16.8", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "30.0.0", test_version_up: "30.0.17.3")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "30.0.17.3", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "31.0.0", test_version_up: "31.0.10")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "31.0.10", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "32.0.0", test_version_up: "32.0.1")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "32.0.1", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);