Database error shown to the user when using a long guest name in richdocuments

Disclosed: 2021-02-07 07:55:38 By hitman_47 To nextcloud
Unknown
Vulnerability Details
When sharing a file to a guest and the file is allow for editing, the user is asked to enter a guestname if you enter a really long value for that name you get a database error that displays sensitive information: An exception occurred while executing 'INSERT INTO `oc_richdocuments_wopi`(`fileid`,`owner_uid`,`version`,`canwrite`,`server_host`,`token`,`expiry`,`guest_displayname`,`template_destination`,`hide_download`,`direct`,`is_remote_token`,`template_id`,`share`) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?)' with params [8606022, "8JaQyYP5xM7w2PJ6", 0, true, "https:\/\/demo2.nextcloud.com\/", "hUYL4uh9Dals51BoAT2YA7WZ1IJMaCLp", 1609196332, "reallylongnameeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee (Guest)", 0, false, false, false, 0, "c4A53CW6wAN2ZZa"]: SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'guest_displayname' at row 1 Demo {F1133198} ## Impact Information Disclosure
Actions
View on HackerOne
Report Stats
  • Report ID: 1067824
  • State: Closed
  • Substate: resolved
  • Upvotes: 28
Share this report