diff options
author | Roeland Jago Douma <roeland@famdouma.nl> | 2018-08-03 13:43:10 +0300 |
---|---|---|
committer | Jos Poortvliet <jos@opensuse.org> | 2018-08-03 21:03:54 +0300 |
commit | 0b2948ecbb6db867f07f5dfe81a0cee873db6d4a (patch) | |
tree | 18842149928ce4a21f10e6021b681898fb205f4d /advisories | |
parent | f7b5daa794aad212e0a460367c5bf3c02fe45131 (diff) |
Add advisories
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Diffstat (limited to 'advisories')
-rw-r--r-- | advisories/advisories.rss | 12 | ||||
-rw-r--r-- | advisories/full-list.php | 63 | ||||
-rw-r--r-- | advisories/nc-sa-2018-006.php | 35 | ||||
-rw-r--r-- | advisories/nc-sa-2018-007.php | 34 |
4 files changed, 118 insertions, 26 deletions
diff --git a/advisories/advisories.rss b/advisories/advisories.rss index 03d9cfc9..0eee2deb 100644 --- a/advisories/advisories.rss +++ b/advisories/advisories.rss @@ -5,6 +5,18 @@ <link>https://nextcloud.com/security/advisories/</link> <description>The Nextcloud security advisories as a RSS feed</description> <ttl>1800</ttl><item> + <title>Server: Bypass of 2 Factor Authentication (NC-SA-2018-007)</title> + <description><p>Improper authentication of the second factor challenge would allow an attacker that had access to user credentials to bypass the second factor validation completely.</p><br/><hr/><p><strong><a href="https://nextcloud.com/security/advisory/?id=nC-SA-2018-007">For more information please consult the official advisory.</a></strong></p></description> + <link>https://nextcloud.com/security/advisory/?id=nC-SA-2018-007</link> + <guid isPermaLink="true">https://nextcloud.com/security/advisory/?id=nC-SA-2018-007</guid> + <pubDate>Fri, 03 Aug 2018 14:00:00 +0200</pubDate> + </item><item> + <title>Server: Improper validation of data passed to JSON encoder (NC-SA-2018-006)</title> + <description><p>Improper validation of input allowed an attacker to not have their actions logged to the audit log.</p><br/><hr/><p><strong><a href="https://nextcloud.com/security/advisory/?id=nC-SA-2018-006">For more information please consult the official advisory.</a></strong></p></description> + <link>https://nextcloud.com/security/advisory/?id=nC-SA-2018-006</link> + <guid isPermaLink="true">https://nextcloud.com/security/advisory/?id=nC-SA-2018-006</guid> + <pubDate>Fri, 03 Aug 2018 14:00:00 +0200</pubDate> + </item><item> <title>Contacts App: Stored XSS in contacts via group shares (NC-SA-2018-005)</title> <description><p>A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.</p><br/><hr/><p><strong><a href="https://nextcloud.com/security/advisory/?id=nC-SA-2018-005">For more information please consult the official advisory.</a></strong></p></description> <link>https://nextcloud.com/security/advisory/?id=nC-SA-2018-005</link> diff --git a/advisories/full-list.php b/advisories/full-list.php index 3dcd58cc..dabe9220 100644 --- a/advisories/full-list.php +++ b/advisories/full-list.php @@ -2,16 +2,27 @@ <h2>2018</h2> +<h3>Nextcloud Server 12.0.3</h3> +<ul> + <li><a href="/security/advisory/?id=NC-SA-2018-006">Improper validation of data passed to JSON encoder (NC-SA-2018-006)</a> 2018-08-03</li> + <li><a href="/security/advisory/?id=NC-SA-2018-007">Bypass of 2 Factor Authentication (NC-SA-2018-007)</a> 2018-08-03</li> +</ul> + +<h3>Nextcloud Server 11.0.5</h3> +<ul> + <li><a href="/security/advisory/?id=NC-SA-2018-006">Improper validation of data passed to JSON encoder (NC-SA-2018-006)</a> 2018-08-03</li> +</ul> + <h3>Nextcloud Server 13.0.3</h3> <ul> - <li><a href="/security/advisory/?id=NC-SA-2018-003">Improper validation on OAuth2 token endpoint (NC-SA-2018-003)</a> 2018-06-21</li> <li><a href="/security/advisory/?id=NC-SA-2018-002">File access control rules not applied to image previews (NC-SA-2018-002)</a> 2018-06-21</li> + <li><a href="/security/advisory/?id=NC-SA-2018-003">Improper validation on OAuth2 token endpoint (NC-SA-2018-003)</a> 2018-06-21</li> </ul> <h3>Nextcloud Server 12.0.8</h3> <ul> - <li><a href="/security/advisory/?id=NC-SA-2018-003">Improper validation on OAuth2 token endpoint (NC-SA-2018-003)</a> 2018-06-21</li> <li><a href="/security/advisory/?id=NC-SA-2018-002">File access control rules not applied to image previews (NC-SA-2018-002)</a> 2018-06-21</li> + <li><a href="/security/advisory/?id=NC-SA-2018-003">Improper validation on OAuth2 token endpoint (NC-SA-2018-003)</a> 2018-06-21</li> </ul> <h3>Calendar App 1.6.1</h3> @@ -45,23 +56,23 @@ <h3>Nextcloud Server 11.0.3</h3> <ul> + <li><a href="/security/advisory/?id=NC-SA-2017-010">Stored XSS in Gallery application (NC-SA-2017-010)</a> 2017-05-08</li> + <li><a href="/security/advisory/?id=NC-SA-2017-011">Share tokens for public calendars disclosed (NC-SA-2017-011)</a> 2017-05-08</li> + <li><a href="/security/advisory/?id=NC-SA-2017-007">DOM XSS vulnerability in search dialogue (NC-SA-2017-007)</a> 2017-05-08</li> <li><a href="/security/advisory/?id=NC-SA-2017-009">Limitation of app specific password scope can be bypassed (NC-SA-2017-009)</a> 2017-05-08</li> <li><a href="/security/advisory/?id=NC-SA-2017-008">Reflected XSS in error pages (NC-SA-2017-008)</a> 2017-05-08</li> - <li><a href="/security/advisory/?id=NC-SA-2017-007">DOM XSS vulnerability in search dialogue (NC-SA-2017-007)</a> 2017-05-08</li> - <li><a href="/security/advisory/?id=NC-SA-2017-011">Share tokens for public calendars disclosed (NC-SA-2017-011)</a> 2017-05-08</li> - <li><a href="/security/advisory/?id=NC-SA-2017-010">Stored XSS in Gallery application (NC-SA-2017-010)</a> 2017-05-08</li> </ul> <h3>Nextcloud Server 10.0.5</h3> <ul> - <li><a href="/security/advisory/?id=NC-SA-2017-008">Reflected XSS in error pages (NC-SA-2017-008)</a> 2017-05-08</li> <li><a href="/security/advisory/?id=NC-SA-2017-010">Stored XSS in Gallery application (NC-SA-2017-010)</a> 2017-05-08</li> + <li><a href="/security/advisory/?id=NC-SA-2017-008">Reflected XSS in error pages (NC-SA-2017-008)</a> 2017-05-08</li> </ul> <h3>Nextcloud Server 9.0.58</h3> <ul> - <li><a href="/security/advisory/?id=NC-SA-2017-008">Reflected XSS in error pages (NC-SA-2017-008)</a> 2017-05-08</li> <li><a href="/security/advisory/?id=NC-SA-2017-010">Stored XSS in Gallery application (NC-SA-2017-010)</a> 2017-05-08</li> + <li><a href="/security/advisory/?id=NC-SA-2017-008">Reflected XSS in error pages (NC-SA-2017-008)</a> 2017-05-08</li> </ul> <h3>Nextcloud Server 11.0.2</h3> @@ -76,43 +87,43 @@ <h3>Nextcloud Server 10.0.2</h3> <ul> - <li><a href="/security/advisory/?id=NC-SA-2017-003">Error message discloses existence of file in write-only share (NC-SA-2017-003)</a> 2017-02-05</li> - <li><a href="/security/advisory/?id=NC-SA-2017-002">Creation of folders in read-only folders despite lacking permissions (NC-SA-2017-002)</a> 2017-02-05</li> - <li><a href="/security/advisory/?id=NC-SA-2017-005">Bypassing quota limitation (NC-SA-2017-005)</a> 2017-02-05</li> <li><a href="/security/advisory/?id=NC-SA-2017-004">Denial of Service attack (NC-SA-2017-004)</a> 2017-02-05</li> - <li><a href="/security/advisory/?id=NC-SA-2017-006">Content-Spoofing in "files" app (NC-SA-2017-006)</a> 2017-02-05</li> <li><a href="/security/advisory/?id=NC-SA-2017-001">Permission increase on re-sharing via OCS API (NC-SA-2017-001)</a> 2017-02-05</li> + <li><a href="/security/advisory/?id=NC-SA-2017-002">Creation of folders in read-only folders despite lacking permissions (NC-SA-2017-002)</a> 2017-02-05</li> + <li><a href="/security/advisory/?id=NC-SA-2017-003">Error message discloses existence of file in write-only share (NC-SA-2017-003)</a> 2017-02-05</li> + <li><a href="/security/advisory/?id=NC-SA-2017-006">Content-Spoofing in "files" app (NC-SA-2017-006)</a> 2017-02-05</li> + <li><a href="/security/advisory/?id=NC-SA-2017-005">Bypassing quota limitation (NC-SA-2017-005)</a> 2017-02-05</li> </ul> <h3>Nextcloud Server 9.0.55</h3> <ul> - <li><a href="/security/advisory/?id=NC-SA-2017-003">Error message discloses existence of file in write-only share (NC-SA-2017-003)</a> 2017-02-05</li> - <li><a href="/security/advisory/?id=NC-SA-2017-002">Creation of folders in read-only folders despite lacking permissions (NC-SA-2017-002)</a> 2017-02-05</li> - <li><a href="/security/advisory/?id=NC-SA-2017-005">Bypassing quota limitation (NC-SA-2017-005)</a> 2017-02-05</li> <li><a href="/security/advisory/?id=NC-SA-2017-004">Denial of Service attack (NC-SA-2017-004)</a> 2017-02-05</li> - <li><a href="/security/advisory/?id=NC-SA-2017-006">Content-Spoofing in "files" app (NC-SA-2017-006)</a> 2017-02-05</li> <li><a href="/security/advisory/?id=NC-SA-2017-001">Permission increase on re-sharing via OCS API (NC-SA-2017-001)</a> 2017-02-05</li> + <li><a href="/security/advisory/?id=NC-SA-2017-002">Creation of folders in read-only folders despite lacking permissions (NC-SA-2017-002)</a> 2017-02-05</li> + <li><a href="/security/advisory/?id=NC-SA-2017-003">Error message discloses existence of file in write-only share (NC-SA-2017-003)</a> 2017-02-05</li> + <li><a href="/security/advisory/?id=NC-SA-2017-006">Content-Spoofing in "files" app (NC-SA-2017-006)</a> 2017-02-05</li> + <li><a href="/security/advisory/?id=NC-SA-2017-005">Bypassing quota limitation (NC-SA-2017-005)</a> 2017-02-05</li> </ul> <hr> <h2>2016</h2> -<h3>Nextcloud Server 10.0.1</h3> +<h3>Nextcloud Server 9.0.54</h3> <ul> - <li><a href="/security/advisory/?id=NC-SA-2016-009">Reflected XSS in Gallery application (NC-SA-2016-009)</a> 2016-10-10</li> - <li><a href="/security/advisory/?id=NC-SA-2016-008">Stored XSS in CardDAV image export (NC-SA-2016-008)</a> 2016-10-10</li> - <li><a href="/security/advisory/?id=NC-SA-2016-011">Content-Spoofing in "dav" app (NC-SA-2016-011)</a> 2016-10-10</li> - <li><a href="/security/advisory/?id=NC-SA-2016-010">Content-Spoofing in "files" app (NC-SA-2016-010)</a> 2016-10-10</li> <li><a href="/security/advisory/?id=NC-SA-2016-006">SMB User Authentication Bypass (NC-SA-2016-006)</a> 2016-10-10</li> + <li><a href="/security/advisory/?id=NC-SA-2016-010">Content-Spoofing in "files" app (NC-SA-2016-010)</a> 2016-10-10</li> + <li><a href="/security/advisory/?id=NC-SA-2016-011">Content-Spoofing in "dav" app (NC-SA-2016-011)</a> 2016-10-10</li> + <li><a href="/security/advisory/?id=NC-SA-2016-007">Improper authorization check on removing shares (NC-SA-2016-007)</a> 2016-10-10</li> </ul> -<h3>Nextcloud Server 9.0.54</h3> +<h3>Nextcloud Server 10.0.1</h3> <ul> - <li><a href="/security/advisory/?id=NC-SA-2016-011">Content-Spoofing in "dav" app (NC-SA-2016-011)</a> 2016-10-10</li> - <li><a href="/security/advisory/?id=NC-SA-2016-010">Content-Spoofing in "files" app (NC-SA-2016-010)</a> 2016-10-10</li> <li><a href="/security/advisory/?id=NC-SA-2016-006">SMB User Authentication Bypass (NC-SA-2016-006)</a> 2016-10-10</li> - <li><a href="/security/advisory/?id=NC-SA-2016-007">Improper authorization check on removing shares (NC-SA-2016-007)</a> 2016-10-10</li> + <li><a href="/security/advisory/?id=NC-SA-2016-009">Reflected XSS in Gallery application (NC-SA-2016-009)</a> 2016-10-10</li> + <li><a href="/security/advisory/?id=NC-SA-2016-010">Content-Spoofing in "files" app (NC-SA-2016-010)</a> 2016-10-10</li> + <li><a href="/security/advisory/?id=NC-SA-2016-008">Stored XSS in CardDAV image export (NC-SA-2016-008)</a> 2016-10-10</li> + <li><a href="/security/advisory/?id=NC-SA-2016-011">Content-Spoofing in "dav" app (NC-SA-2016-011)</a> 2016-10-10</li> </ul> <h3>Nextcloud Server 10.0.0</h3> @@ -122,10 +133,10 @@ <h3>Nextcloud Server 9.0.52</h3> <ul> + <li><a href="/security/advisory/?id=NC-SA-2016-001">Stored XSS in "gallery" application (NC-SA-2016-001)</a> 2016-07-19</li> + <li><a href="/security/advisory/?id=NC-SA-2016-005">Read-only share recipient can restore old versions of file (NC-SA-2016-005)</a> 2016-07-19</li> <li><a href="/security/advisory/?id=NC-SA-2016-003">Content-Spoofing in "files" app (NC-SA-2016-003)</a> 2016-07-19</li> <li><a href="/security/advisory/?id=NC-SA-2016-002">Log pollution can potentially lead to local HTML injection (NC-SA-2016-002)</a> 2016-07-19</li> - <li><a href="/security/advisory/?id=NC-SA-2016-005">Read-only share recipient can restore old versions of file (NC-SA-2016-005)</a> 2016-07-19</li> <li><a href="/security/advisory/?id=NC-SA-2016-004">Edit permission check not enforced on WebDAV COPY action (NC-SA-2016-004)</a> 2016-07-19</li> - <li><a href="/security/advisory/?id=NC-SA-2016-001">Stored XSS in "gallery" application (NC-SA-2016-001)</a> 2016-07-19</li> </ul> diff --git a/advisories/nc-sa-2018-006.php b/advisories/nc-sa-2018-006.php new file mode 100644 index 00000000..746bd2ea --- /dev/null +++ b/advisories/nc-sa-2018-006.php @@ -0,0 +1,35 @@ +<div class="row page-content-header"> +<div class="col-md-4"> + <h1>Security Advisory</h1> + <a href="/security/advisories/">Back to advisories</a> +</div> +</div> +<div class="row"> + <div class="col-md-12"> + <h2>Improper validation of data passed to JSON encoder (NC-SA-2018-006)</h2> + <p>3rd August 2018</p> + <p>Risk level: <strong>Medium</strong></p> + <p>CVSS v3 Base Score: 5.3 (<a href="https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N">AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</a>)</p> + <p>CWE: <a href="https://cwe.mitre.org/data/definitions/20.html">Improper Input Validation (CWE-20)</a></p> + <p>HackerOne report: <a href="https://hackerone.com/reports/232347">232347</a></p> + <h3>Description</h3> + <p><p>Improper validation of input allowed an attacker to not have their actions logged to the audit log.</p> +</p> + <h3>Affected Software</h3> + <ul> + <li>Nextcloud Server < <strong>12.0.3</strong> (2018-3776)</li> +<li>Nextcloud Server < <strong>11.0.5</strong> (2018-3776)</li> + + </ul> + <h3>Action Taken</h3> + <p><p>The error has been fixed.</p> +</p> + <h3>Acknowledgements</h3> + <p>The Nextcloud team thanks the following people for their research and responsible disclosure of the above advisory:</p> + <ul> + <li>Zhouyuan Yang - Fortinet's FortiGuard Labs - Vulnerability discovery and disclosure.</li> + </ul> + <br/> + <small style="color:grey">This advisory is licensed <a href="https://creativecommons.org/licenses/by-sa/4.0/">CC BY-SA 4.0</a>.</small> + </div> +</div> diff --git a/advisories/nc-sa-2018-007.php b/advisories/nc-sa-2018-007.php new file mode 100644 index 00000000..84345974 --- /dev/null +++ b/advisories/nc-sa-2018-007.php @@ -0,0 +1,34 @@ +<div class="row page-content-header"> +<div class="col-md-4"> + <h1>Security Advisory</h1> + <a href="/security/advisories/">Back to advisories</a> +</div> +</div> +<div class="row"> + <div class="col-md-12"> + <h2>Bypass of 2 Factor Authentication (NC-SA-2018-007)</h2> + <p>3rd August 2018</p> + <p>Risk level: <strong>High</strong></p> + <p>CVSS v3 Base Score: 8.1 (<a href="https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N">AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</a>)</p> + <p>CWE: <a href="https://cwe.mitre.org/data/definitions/287.html">Improper Authentication - Generic (CWE-287)</a></p> + <p>HackerOne report: <a href="https://hackerone.com/reports/248656">248656</a></p> + <h3>Description</h3> + <p><p>Improper authentication of the second factor challenge would allow an attacker that had access to user credentials to bypass the second factor validation completely.</p> +</p> + <h3>Affected Software</h3> + <ul> + <li>Nextcloud Server < <strong>12.0.3</strong> (2018-3775)</li> + + </ul> + <h3>Action Taken</h3> + <p><p>The error has been fixed and regression tests are in place.</p> +</p> + <h3>Acknowledgements</h3> + <p>The Nextcloud team thanks the following people for their research and responsible disclosure of the above advisory:</p> + <ul> + <li>kaysbugs - Vulnerability discovery and disclosure.</li> + </ul> + <br/> + <small style="color:grey">This advisory is licensed <a href="https://creativecommons.org/licenses/by-sa/4.0/">CC BY-SA 4.0</a>.</small> + </div> +</div> |