CVE-2019-18214
📋 TL;DR
The Video_Converter app 0.1.0 for Nextcloud allows denial of service via uncontrolled concurrent video conversions. Attackers can trigger multiple FFmpeg processes simultaneously, consuming all available CPU and memory resources. This affects Nextcloud instances with the vulnerable Video_Converter app installed.
💻 Affected Systems
- Nextcloud Video_Converter app
📦 What is this software?
Video Converter by Video Converter Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability due to resource exhaustion, affecting all Nextcloud services and potentially the underlying server.
Likely Case
Service degradation or temporary unavailability of Nextcloud until resource-intensive processes complete or are terminated.
If Mitigated
Minimal impact with proper resource limits and monitoring in place.
🎯 Exploit Status
Exploitation requires no authentication and is trivial - simply trigger multiple concurrent video conversions. The GitHub issue demonstrates the problem clearly.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.1 or later
Vendor Advisory: https://github.com/PaulLereverend/NextcloudVideo_Converter/issues/22
Restart Required: No
Instructions:
1. Update Video_Converter app to version 0.1.1 or later via Nextcloud app store. 2. No server restart required. 3. Verify app version in Nextcloud admin interface.
🔧 Temporary Workarounds
Disable Video_Converter app
linuxTemporarily disable the vulnerable app until patched
occ app:disable video_converter
Limit concurrent processes
linuxUse system resource limits to restrict FFmpeg processes
ulimit -u 50
systemctl edit --full ffmpeg.service
🧯 If You Can't Patch
- Disable the Video_Converter app completely via Nextcloud admin interface
- Implement rate limiting or WAF rules to restrict concurrent conversion requests
🔍 How to Verify
Check if Vulnerable:
Check Video_Converter app version in Nextcloud admin panel → Apps → Installed appsCheck Version:
occ app:list | grep video_converterVerify Fix Applied:
Verify Video_Converter app version is 0.1.1 or higher in Nextcloud admin interface📡 Detection & Monitoring
Log Indicators:
- Multiple FFmpeg processes running simultaneously
- High CPU/memory usage spikes
- Video conversion requests in Nextcloud logs
Network Indicators:
- Multiple concurrent POST requests to /apps/video_converter/ endpoints
SIEM Query:
source="nextcloud.log" AND "video_converter" AND "conversion" | stats count by src_ip