Nextcloud Server up to 22.2.7/23.0.4/24.0.0 SMTP crlf injection

Summaryinfo

A vulnerability was found in Nextcloud Server up to 22.2.7/23.0.4/24.0.0. It has been classified as critical. The impacted element is an unknown function of the component SMTP Handler. The manipulation leads to crlf injection. This vulnerability is listed as CVE-2022-31014. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Nextcloud Server up to 22.2.7/23.0.4/24.0.0 (Cloud Software) and classified as critical. This issue affects an unknown code block of the component SMTP Handler. The manipulation with an unknown input leads to a crlf injection vulnerability. Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, but newlines should be sanitized to mitigate such arbitrary SMTP command injection. It is recommended that the Nextcloud Server is upgraded to 22.2.8 , 23.0.5 or 24.0.1. There are no known workarounds for this issue.

The weakness was presented 07/05/2022 as GHSA-264h-3v4w-6xh2. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2022-31014 since 05/18/2022. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 22.2.8, 23.0.5 or 24.0.1 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Nextcloud

Name

• Server

Version

• 22.2.0
• 22.2.1
• 22.2.2
• 22.2.3
• 22.2.4
• 22.2.5
• 22.2.6
• 22.2.7
• 23.0.0
• 23.0.1
• 23.0.2
• 23.0.3
• 23.0.4
• 24.0

License

• open-source

Website

• Product: https://github.com/nextcloud/server/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion