CVE-2023-35928: Nextcloud user scoped external storage can be used to gather credentials of other users

Published Jun 23, 2023

Updated

Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, a user could use this functionality to get access to the login credentials of another user and take over their account. This issue has been patched in Nextcloud Server versions 25.0.7 and 26.0.2 and NextCloud Enterprise Server versions 19.0.13.9, 20.0.14.14, 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2.

Three workarounds are available. Disable app filesexternal. Change config setting "Allow users to mount external storage" to disabled in "Administration" > "External storage" settings …/index.php/settings/admin/externalstorages. Change config setting to disallow users to create external storages in "Administration" > "External storage" settings …/index.php/settings/admin/externalstorages with the types FTP, Nextcloud, SFTP, and/or WebDAV.

Affected Software

10 affected components

Nextcloud Server>=19.0.0<19.0.13.9

Nextcloud Server>=20.0.0<20.0.14.14

Nextcloud Server>=21.0.0<21.0.9.12

Nextcloud Server>=22.0.0<22.2.10.12

Nextcloud Server>=23.0.0<23.0.12.7

Nextcloud Server>=24.0.0<24.0.12.2

Nextcloud Server>=25.0.0<25.0.7

Nextcloud Server>=26.0.0<26.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nextcloud Server to a version that resolves this vulnerability.
Fixed in 25.0.7
Upgrade
Upgrade Nextcloud Server to a version that resolves this vulnerability.
Fixed in 26.0.2
Upgrade
Upgrade Nextcloud Enterprise Server to a version that resolves this vulnerability.
Fixed in 19.0.13.9
Upgrade
Upgrade Nextcloud Enterprise Server to a version that resolves this vulnerability.
Fixed in 20.0.14.14
Upgrade
Upgrade Nextcloud Enterprise Server to a version that resolves this vulnerability.
Fixed in 21.0.9.12
Upgrade
Upgrade Nextcloud Enterprise Server to a version that resolves this vulnerability.
Fixed in 22.2.10.12
Upgrade
Upgrade Nextcloud Enterprise Server to a version that resolves this vulnerability.
Fixed in 23.0.12.7
Upgrade
Upgrade Nextcloud Enterprise Server to a version that resolves this vulnerability.
Fixed in 24.0.12.2
Upgrade
Upgrade Nextcloud Enterprise Server to a version that resolves this vulnerability.
Fixed in 25.0.7
Upgrade
Upgrade Nextcloud Enterprise Server to a version that resolves this vulnerability.
Fixed in 26.0.2
Configuration
In `Administration` > `External storage` (`…/index.php/settings/admin/externalstorages`), set "Allow users to mount external storage" to disabled.
Administration > External storage (`…/index.php/settings/admin/externalstorages`) Allow users to mount external storage = disabled
Configuration
In `Administration` > `External storage` (`…/index.php/settings/admin/externalstorages`), disallow users from creating external storages for the types FTP, Nextcloud, SFTP, and/or WebDAV.
Administration > External storage (`…/index.php/settings/admin/externalstorages`) External storage creation (FTP/Nextcloud/SFTP/WebDAV) = disallow
Configuration
Disable the Nextcloud app `files_external`.
Nextcloud app `files_external` app enabled/disabled = disabled

Event History

Jun 23, 2023

CVE Published

via MITRE·08:58 PM

Data Sourced

via MITRE·08:58 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-35928?

CVE-2023-35928 is a vulnerability in Nextcloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, and 24.0.0 until 24.0.12.2 that can allow an attacker to execute arbitrary code.

What is the severity of CVE-2023-35928?

The severity of CVE-2023-35928 is rated as high with a CVSS score of 8.8.

How do I know if I am affected by CVE-2023-35928?

If you are using Nextcloud Server versions 25.0.0 until 25.0.7 or 26.0.0 until 26.0.2, or Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, or 24.0.0 until 24.0.12.2, you may be affected by CVE-2023-35928.

How can I fix CVE-2023-35928?

To fix CVE-2023-35928, upgrade to a patched version of Nextcloud Server or Nextcloud Enterprise Server. Check the Nextcloud security advisories for the specific patched versions for each affected series.

Where can I find more information about CVE-2023-35928?

You can find more information about CVE-2023-35928 in the Nextcloud security advisories, GitHub security advisories, and the HackerOne report.