Default Nextcloud server config and iOS Nextcloud client leak sharee searches to Nextcloud

Disclosed: 2021-05-31 10:52:15 By rtod To nextcloud
Low
Vulnerability Details
In short this is the same as https://hackerone.com/reports/1167916 but then for iOS so please forgive the copy paste On a clean Nextcloud setup the functionality "Search global and public address book for users" is enabled. Now when searching for a sharee to share with. The lookup parameter is not passed to the server. Resulting in https://github.com/nextcloud/server/blob/master/apps/files_sharing/lib/Controller/ShareesAPIController.php#L144 the lookup being true. So the lookup server of Nextcloud will be searched by default. ## Impact Anybody sharing trough the android app. Leaks their sharee searches to the Nextcloud lookup server. Now the server can can only see the origin Nextcloud server (or rather the IP of that). Still. This should not be leaked by default. On the web and desktop there is first a local search. And only if the user explicitly presses the search globally the lookup server is queried. (to be fair this could also be more clear that it actually sends data to other systems)
Actions
View on HackerOne
Report Stats
  • Report ID: 1167919
  • State: Closed
  • Substate: resolved
  • Upvotes: 6
Share this report