CVE-2021-41178 Information

Description

Nextcloud is an open-source self-hosted productivity platform. Prior to versions 20.0.13 21.0.5 and 22.2.0 a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system including user provided files. This could also be leveraged into a XSS/phishing attack an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Reference

https://hackerone.com/reports/1302155 https://github.com/nextcloud/server/pull/28726 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jp9c-vpr3-m5rf

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

6.5