External storage app saves password for all users in the database

Disclosed: 2021-03-01 11:01:47 By alacn1 To nextcloud
High
Vulnerability Details
External storage (files_external) app save passwords of all users to database table "oc_credentials" even when "Log-in credentials, save in database" option is not used. It's a security risk that allow password extraction of all users. A local system admin that has access to database and nextcloud config file could decrypt any user password. ### Steps to reproduce 1. Enable app "External storage support" (files_external). 2. Login to nextcloud. 3. User recoverable password will be saved to table "oc_credentials" at "password::logincredentials/credentials". ### Expected behaviour Don't save user password to table "oc_credentials" unless user has a mount with "Log-in credentials, save in database" option. ### Actual behaviour Passwords of all users is saved to table "oc_credentials" when files_external app is enabled. ### Tested with Nextcloud 18.0.4 + External storage 1.9.0 Nextcloud 17.0.5 + External storage 1.8.0 ## Impact A local system admin could recover any user password.
Actions
View on HackerOne
Report Stats
  • Report ID: 867164
  • State: Closed
  • Substate: resolved
  • Upvotes: 3
Share this report