CVE-2023-35172
📋 TL;DR
This vulnerability allows attackers to brute-force password reset links in NextCloud Server and NextCloud Enterprise Server, potentially enabling unauthorized account access. Affected users include all organizations running vulnerable versions of NextCloud's self-hosted file storage and productivity platform.
💻 Affected Systems
- NextCloud Server
- NextCloud Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to user accounts, potentially compromising sensitive data, performing unauthorized actions, or escalating privileges within the NextCloud instance.
Likely Case
Attackers reset passwords for targeted accounts, gaining access to files and functionality available to those users, potentially leading to data theft or further system compromise.
If Mitigated
With proper rate limiting and monitoring, brute-force attempts are detected and blocked before successful exploitation, limiting impact to isolated incidents.
🎯 Exploit Status
Brute-force attacks require no authentication and can be automated with simple tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NextCloud Server: 25.0.7, 26.0.2; NextCloud Enterprise Server: 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, 26.0.2
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mjf5-p765-qmr6
Restart Required: No
Instructions:
1. Backup your NextCloud instance. 2. Update to the patched version via NextCloud's updater or manual installation. 3. Verify the update completed successfully.
🧯 If You Can't Patch
- Implement strict rate limiting on password reset endpoints via web application firewall or reverse proxy.
- Monitor logs for excessive password reset attempts and implement alerting.
🔍 How to Verify
Check if Vulnerable:
Check your NextCloud version via the admin dashboard or by examining config/config.php for 'version' field.Check Version:
php occ config:system:get versionVerify Fix Applied:
Confirm version is updated to patched versions listed above and test password reset functionality with monitoring tools.📡 Detection & Monitoring
Log Indicators:
- Multiple failed password reset attempts from single IP
- Unusual patterns of password reset requests
Network Indicators:
- High volume of POST requests to /index.php/lostpassword/* endpoints
SIEM Query:
source="nextcloud.log" AND "lostpassword" AND status=200 | stats count by src_ip🔗 References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mjf5-p765-qmr6
- https://github.com/nextcloud/server/pull/38267
- https://hackerone.com/reports/1987062
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mjf5-p765-qmr6
- https://github.com/nextcloud/server/pull/38267
- https://hackerone.com/reports/1987062
