CVE-2024-37883
📋 TL;DR
This vulnerability in Nextcloud Deck allows users with access to a deck board to view comments and attachments from deleted cards, bypassing intended access controls. It affects all Nextcloud instances running vulnerable versions of the Deck app. The issue stems from improper access restriction (CWE-284).
💻 Affected Systems
- Nextcloud Deck
📦 What is this software?
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Sensitive information from deleted cards could be exposed to unauthorized users, potentially leaking confidential project details, attachments, or private communications.
Likely Case
Users with board access can view historical comments and attachments they shouldn't have access to, violating data privacy expectations.
If Mitigated
With proper access controls and monitoring, impact is limited to information disclosure within already-trusted users who have board access.
🎯 Exploit Status
Exploitation requires existing user credentials with board access. No special tools or techniques needed beyond normal board navigation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.6, 1.7.5, 1.8.7, 1.9.6, 1.11.3, or 1.12.1
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8
Restart Required: No
Instructions:
1. Log into Nextcloud as admin. 2. Go to Apps → Deck. 3. Click 'Update' if available. 4. Alternatively, update via command line: sudo -u www-data php occ app:update deck
🔧 Temporary Workarounds
Disable Deck app
linuxTemporarily disable the Deck app to prevent exploitation while planning update.
sudo -u www-data php occ app:disable deck
Restrict board access
allReview and minimize board permissions to reduce attack surface.
🧯 If You Can't Patch
- Audit board permissions and remove unnecessary user access
- Monitor deck activity logs for unusual access patterns to deleted cards
🔍 How to Verify
Check if Vulnerable:
Check Deck app version in Nextcloud admin interface under Apps → Deck, or run: sudo -u www-data php occ app:list | grep deckCheck Version:
sudo -u www-data php occ app:list | grep deckVerify Fix Applied:
Confirm Deck version is 1.6.6, 1.7.5, 1.8.7, 1.9.6, 1.11.3, or 1.12.1 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to deleted cards in deck logs
- Multiple failed attempts to access deleted card content
Network Indicators:
- Increased API calls to deck endpoints related to deleted cards
SIEM Query:
source="nextcloud.log" AND "deck" AND ("deleted" OR "access" OR "unauthorized")🔗 References
- https://github.com/nextcloud/deck/pull/5423
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8
- https://hackerone.com/reports/2289333
- https://github.com/nextcloud/deck/pull/5423
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8
- https://hackerone.com/reports/2289333
