CVE-2023-25162

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage enclosed alphanumeric payloads to bypass IP filters and gain SSRF, which would allow an attacker to read crucial metadata if the server is hosted on the AWS platform. Nextcloud Server 24.0.8 and 23.0.2 and Nextcloud Enterprise Server 24.0.8 and 23.0.12 contain a patch for this issue. No known workarounds are available.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mqrx-grp7-244m	Vendor Advisory
https://github.com/nextcloud/server/pull/34160	Issue Tracking
https://hackerone.com/reports/1702864	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:nextcloud_server::::::::
	cpe:2.3:a:nextcloud:nextcloud_server::::::::

History

23 Feb 2023, 19:56

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CWE		CWE-918
CPE		cpe:2.3:a:nextcloud:nextcloud_server::::::::
First Time		Nextcloud Nextcloud nextcloud Server
References	~~(MISC) https://github.com/nextcloud/server/pull/34160 -~~	(MISC) https://github.com/nextcloud/server/pull/34160 - Issue Tracking
References	~~(MISC) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mqrx-grp7-244m -~~	(MISC) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mqrx-grp7-244m - Vendor Advisory
References	~~(MISC) https://hackerone.com/reports/1702864 -~~	(MISC) https://hackerone.com/reports/1702864 - Exploit, Third Party Advisory

13 Feb 2023, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-02-13 21:15

Updated : 2023-12-10 14:48

NVD link : CVE-2023-25162

Mitre link : CVE-2023-25162

CVE.ORG link : CVE-2023-25162

JSON object : View

Products Affected

nextcloud

nextcloud_server

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2023-25162", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-02-13T21:15:15.140", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mqrx-grp7-244m", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/server/pull/34160", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/1702864", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage enclosed alphanumeric payloads to bypass IP filters and gain SSRF, which would allow an attacker to read crucial metadata if the server is hosted on the AWS platform. Nextcloud Server 24.0.8 and 23.0.2 and Nextcloud Enterprise Server 24.0.8 and 23.0.12 contain a patch for this issue. No known workarounds are available."}], "lastModified": "2023-02-23T19:56:18.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B50151BE-566E-4F7F-BFF5-CDBA5A0AE4B8", "versionEndExcluding": "23.0.12"}, {"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7827F3FA-9D17-4915-90CB-B3652E310F0E", "versionEndExcluding": "24.0.8", "versionStartIncluding": "24.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}