CVE-2023-28998: Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.
Other sources
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.? Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-28998?
CVE-2023-28998 is a vulnerability in the Nextcloud Desktop Client that allows a malicious server administrator to gain full access to an end-to-end encrypted folder.
What is the severity of CVE-2023-28998?
The severity of CVE-2023-28998 is medium, with a severity value of 6.1.
How does CVE-2023-28998 affect Nextcloud Desktop Client?
CVE-2023-28998 affects Nextcloud Desktop Client versions 3.0.0 to 3.6.5, allowing a malicious server administrator to decrypt files, recover the folder structure, and add new files.
Is there a fix for CVE-2023-28998?
Yes, a fix for CVE-2023-28998 is available in version 3.6.5 of the Nextcloud Desktop Client.
Where can I find more information about CVE-2023-28998?
More information about CVE-2023-28998 can be found in the ETH Zurich report and the Nextcloud Desktop Client GitHub pull request and security advisories.