Nextcloud Path Traversal CVE-2024-3943: Analysis & POC

Vulnerability Summary: Path Traversal in nextRedirect() and nextBackup() Vulnerability Overview Vulnerability Name: Path Traversal in nextRedirect() and nextBackup() Vulnerability ID: CVE-2024-3943 CVSS Score: 7.7 / 10 (High) Affected Components: nextcloud/nextcloud versions 10.0.6 and 10.0.7 Vulnerability Type: Path Traversal Attack Vector: Direct control of file paths via GET parameters, bypassing whitelist validation to read arbitrary files Trigger Functions: Calls to the function within and Critical Issue: Insufficient filtering of the parameter, allowing path traversal characters such as Scope of Impact Affected Versions: - nextcloud/nextcloud 10.0.6 - nextcloud/nextbackup 10.0.7 Affected Files: - - (in nextBackup) Impacted Functionality: - Users can construct malicious URLs to read arbitrary files on the server (e.g., , ) - May lead to severe consequences such as sensitive information disclosure and Remote Code Execution (RCE) Remediation Official Fixed Versions: - nextcloud/nextcloud 10.0.8+ - nextbackup 10.0.8+ Fix Details: - Added strict validation for the parameter in the function - Blocked inclusion of or other path traversal characters - Implemented URL validation using functions like or Temporary Mitigation Measures: - Restrict web server access permissions to sensitive directories - Use a WAF to block requests containing - Upgrade to the latest stable version POC Code / Exploit Code > Note: Actual exploitation requires adjusting paths based on the specific environment; some servers may have additional protections enabled. Additional Information Disclosure Date: October 2024 Reporter: Anonymous Researcher Fix Status: Fixed (10.0.8+) Recommended Action: Immediately upgrade to version 10.0.8 or higher and review logs for any abnormal access records

Goal Reached Thanks to every supporter — we hit 100%!

Nextcloud Path Traversal CVE-2024-3943: Analysis & POC

More from this source