CVE-2021-32802
📋 TL;DR
Nextcloud servers with image previews enabled are vulnerable to server-side request forgery (SSRF), file disclosure, or potential remote code execution when processing malicious image files. This affects self-hosted Nextcloud instances using vulnerable third-party image processing libraries. Attackers could exploit this by uploading specially crafted images.
💻 Affected Systems
- Nextcloud Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or lateral movement within the network.
Likely Case
Server-side request forgery allowing internal network scanning and file disclosure from the Nextcloud server.
If Mitigated
Limited impact with proper network segmentation and previews disabled.
🎯 Exploit Status
Exploitation requires authenticated user access to upload files. Public proof-of-concept exists in HackerOne report #1261413.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.0.12, 21.0.4, or 22.1.0
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7
Restart Required: Yes
Instructions:
1. Backup your Nextcloud instance and database. 2. Update Nextcloud via the web updater or manual download. 3. Run occ upgrade command. 4. Restart web server services.
🔧 Temporary Workarounds
Disable Image Previews
allCompletely disable image preview generation in Nextcloud configuration
Edit config.php and add: 'enable_previews' => false
🧯 If You Can't Patch
- Disable image previews immediately via config.php
- Restrict file upload permissions and monitor for suspicious image uploads
🔍 How to Verify
Check if Vulnerable:
Check Nextcloud version via Admin panel or run: php occ status | grep versionCheck Version:
php occ status | grep versionVerify Fix Applied:
Confirm version is 20.0.12+, 21.0.4+, or 22.1.0+ and verify previews are disabled if using workaround📡 Detection & Monitoring
Log Indicators:
- Unusual image processing errors in Nextcloud logs
- Multiple failed preview generation attempts
- Large or malformed image uploads
Network Indicators:
- Outbound requests from Nextcloud server to internal services
- Unexpected file access patterns
SIEM Query:
source="nextcloud.log" AND ("preview" OR "image" OR "upload") AND (error OR failed OR exception)🔗 References
- https://docs.nextcloud.com/server/21/admin_manual/configuration_files/previews_configuration.html#disabling-previews
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7
- https://hackerone.com/reports/1261413
- https://security.gentoo.org/glsa/202208-17
- https://docs.nextcloud.com/server/21/admin_manual/configuration_files/previews_configuration.html#disabling-previews
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7
- https://hackerone.com/reports/1261413
- https://security.gentoo.org/glsa/202208-17
