Nextcloud Server <24.0.10 - Workflow Scope Validation Bypass to Code Execution
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2023-26482.
PoCs published by ISabbiI, Enis Maholli, arianitisufi, Armend Gashi, whotwagner, including Metasploit module exploits/unix/webapp/nextcloud_workflows_rce.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-26482, a Missing Scope Validation vulnerability in Nextcloud Server. The exploit demonstrates how an authenticated non-admin user can create a malicious workflow rule to achieve Remote Code Execution (RCE) when the 'Workflow Script' app is installed.
Description
Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app `workflow_scripts` and `workflow_pdf_converter` as a mitigation.
Exploits (2)
This repository contains a functional exploit for CVE-2023-26482, a Missing Scope Validation vulnerability in Nextcloud Server. The exploit demonstrates how an authenticated non-admin user can create a malicious workflow rule to achieve Remote Code Execution (RCE) when the 'Workflow Script' app is installed.
This Metasploit module exploits CVE-2023-26482 in Nextcloud Workflows, allowing authenticated users to execute arbitrary commands via the Workflow Script app by creating a malicious workflow and triggering it through file upload.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H