CVE-2024-52515
📋 TL;DR
This vulnerability in Nextcloud Server allows a malicious user to upload a manipulated SVG file that references other file paths. If the referenced file exists, the SVG preview will display that other file's content instead. This affects Nextcloud instances where the default-disabled SVG preview provider has been manually enabled by an administrator.
💻 Affected Systems
- Nextcloud Server
- Nextcloud Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could preview sensitive files they shouldn't have access to, potentially exposing confidential information stored in the Nextcloud instance.
Likely Case
Information disclosure where users can preview files they shouldn't have access to, violating access controls.
If Mitigated
No impact if SVG preview provider remains disabled or if proper patching is applied.
🎯 Exploit Status
Requires authenticated user access and admin to have enabled SVG preview provider
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 27.1.10, 28.0.6, 29.0.1 for Nextcloud Server; 24.0.12.15, 25.0.13.10, 26.0.13.4, 27.1.10, 28.0.6, 29.0.1 for Nextcloud Enterprise Server
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5m5g-hw8c-2236
Restart Required: No
Instructions:
1. Backup your Nextcloud instance. 2. Update to the patched version using your preferred update method (web updater, occ command, or manual download). 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable SVG preview provider
allDisable the SVG preview provider if it was previously enabled
Edit config/config.php and ensure 'enabledPreviewProviders' does not include 'OC\Preview\SVG'
🧯 If You Can't Patch
- Disable SVG preview provider in configuration
- Restrict SVG file uploads or implement content filtering for SVG files
🔍 How to Verify
Check if Vulnerable:
Check if SVG preview provider is enabled in config/config.php and verify Nextcloud version is below patched versionsCheck Version:
php occ status | grep 'versionstring'Verify Fix Applied:
Verify Nextcloud version is at or above patched versions and SVG preview provider is either disabled or patched version is installed📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Preview generation errors for SVG files
- Access to files via preview mechanism
Network Indicators:
- Increased preview generation requests for SVG files
SIEM Query:
Search for SVG file uploads followed by preview generation requests to unusual file paths