Trusted server shared secret stored unencrypted in the database

Disclosed: 2021-06-16 08:56:40 By rtod To nextcloud
Low
Vulnerability Details
The attack vector here is that somebody gets their hands on your database. When two servers have added each other as trusted server they exchange shared secret token. With this token they can sync down each other user lists. However it seems that this token is stored in plain text in the `oc_trusted_servers` table. This seems especially odd since you do store credentials for external storage encrypted in the database. Simply encrypting the shared secret in the database would help. ## Impact If the database of a system is compromised the attacker can easily obtain the token of any trusted server. And keep syncing down the address book with that.
Actions
View on HackerOne
Report Stats
  • Report ID: 1173670
  • State: Closed
  • Substate: informative
  • Upvotes: 2
Share this report