Nextcloud Server up to 24.0.9/25.0.3 Share weak prng

Summaryinfo

A vulnerability classified as problematic was found in Nextcloud Server up to 24.0.9/25.0.3. This affects an unknown part of the component Share Handler. Executing a manipulation can lead to weak prng. The identification of this vulnerability is CVE-2023-28835. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Nextcloud Server up to 24.0.9/25.0.3 (Cloud Software) and classified as problematic. This vulnerability affects an unknown function of the component Share Handler. The manipulation with an unknown input leads to a weak prng vulnerability. The CWE definition for the vulnerability is CWE-338. The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. As an impact it is known to affect confidentiality. CVE summarizes:

Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when the sharer did not change it the password could be guessable to an attacker willing to brute force it. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. This issue only affects users who do not have a password policy enabled, so enabling a password policy is an effective mitigation for users unable to upgrade.

The weakness was shared 03/31/2023 as GHSA-7w2p-rp9m-9xp9. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-28835 since 03/24/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

Upgrading to version 24.0.10 or 25.0.4 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Nextcloud

Name

• Server

Version

• 24.0.0
• 24.0.1
• 24.0.2
• 24.0.3
• 24.0.4
• 24.0.5
• 24.0.6
• 24.0.7
• 24.0.8
• 24.0.9
• 25.0.0
• 25.0.1
• 25.0.2
• 25.0.3

License

• open-source

Website

• Product: https://github.com/nextcloud/server/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion