CVE-2021-37617: Untrusted Search Path in Nextcloud Desktop Client
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3 through 3.2.4, the Client searches the Uninstall.exe file in a folder that can be written by regular users. This could lead to a case where a malicious user creates a malicious Uninstall.exe, which would be executed with administrative privileges on the Nextcloud Desktop Client installation. This issue is fixed in Nextcloud Desktop Client version 3.3.0. As a workaround, do not allow untrusted users to create content in the C:\ system folder and verify that there is no malicious C:\Uninstall.exe file on the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nextcloud Desktop Clientto a version that resolves this vulnerability.Fixed in 3.3.0 - Configuration
As a workaround, do not allow untrusted users to create content in the C:\ system folder.
Windows file system Write/creation permissions for C:\ system folder = Disallow untrusted users from creating content in C:\ - Operational
Verify that there is no malicious C:\Uninstall.exe file on the system.
Event History
Frequently Asked Questions
What is CVE-2021-37617?
CVE-2021-37617 is a vulnerability in the Nextcloud Desktop Client that can allow remnants of previous installations to remain on a computer.
How does CVE-2021-37617 affect Nextcloud Desktop Client?
CVE-2021-37617 affects Nextcloud Desktop Client versions 3.0.3 through 3.2.4, allowing remnants of previous installations to persist.
What is the severity of CVE-2021-37617?
CVE-2021-37617 has a severity level of 7.3 (high).
How can I fix CVE-2021-37617?
To fix CVE-2021-37617, update your Nextcloud Desktop Client to version 3.3.0 or higher.
Where can I find more information about CVE-2021-37617?
You can find more information about CVE-2021-37617 at the following references: [GitHub pull request](https://github.com/nextcloud/desktop/pull/3497), [Nextcloud security advisory](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q2w-v879-q24v), [HackerOne report](https://hackerone.com/reports/1240749).