CVE-2021-37628
📋 TL;DR
This vulnerability in Nextcloud Richdocuments allows attackers to bypass 'Upload Only' file drop restrictions and read arbitrary files from public link shares. It affects Nextcloud instances using the Richdocuments app with vulnerable versions. Organizations using Nextcloud for collaborative document editing are impacted.
💻 Affected Systems
- Nextcloud Richdocuments
📦 What is this software?
Richdocuments by Nextcloud
Richdocuments by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Unauthenticated attackers could access sensitive files shared via 'Upload Only' links, potentially exposing confidential documents, personal data, or internal information.
Likely Case
Attackers with knowledge of public share links could read files they shouldn't have access to, violating the intended 'upload only' restriction.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized file reads from specific share links rather than full system compromise.
🎯 Exploit Status
Exploitation requires knowledge of public share URLs but no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.8.4 or 4.2.1
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxhh-954f-8w7w
Restart Required: No
Instructions:
1. Update Nextcloud Richdocuments app via Nextcloud admin interface or command line. 2. For command line: sudo -u www-data php occ app:update richdocuments. 3. Verify update completed successfully.
🔧 Temporary Workarounds
Disable Richdocuments App
linuxTemporarily disable the vulnerable Richdocuments application
sudo -u www-data php occ app:disable richdocuments
🧯 If You Can't Patch
- Disable all 'Upload Only' public link shares in Nextcloud settings
- Monitor access logs for unusual file access patterns from Richdocuments endpoints
🔍 How to Verify
Check if Vulnerable:
Check Richdocuments app version in Nextcloud admin interface under Apps > Office & TextCheck Version:
sudo -u www-data php occ app:list | grep richdocumentsVerify Fix Applied:
Verify Richdocuments version is 3.8.4 or higher (for v3) or 4.2.1 or higher (for v4)📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns via Richdocuments endpoints
- Multiple failed access attempts to 'Upload Only' shares
Network Indicators:
- HTTP requests to Richdocuments endpoints with file read operations on public shares
SIEM Query:
source="nextcloud.log" AND ("richdocuments" OR "Upload Only") AND ("GET" OR "read") AND NOT "upload"🔗 References
- https://github.com/nextcloud/richdocuments/pull/1664
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxhh-954f-8w7w
- https://hackerone.com/reports/1253403
- https://github.com/nextcloud/richdocuments/pull/1664
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxhh-954f-8w7w
- https://hackerone.com/reports/1253403
