Bug 1218981 (CVE-2024-22403)

Summary:	VUL-0: CVE-2024-22403: nextcloud: OAuth codes did not expire
Product:	[openSUSE] openSUSE Distribution	Reporter:	SMASH SMASH <smash_bz>
Component:	Other	Assignee:	Eric Schirra <ecsos>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	andrea.mattiazzo
Version:	Leap 15.6
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/391700/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-01-19 09:04:05 UTC

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22403
https://www.cve.org/CVERecord?id=CVE-2024-22403
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36
https://hackerone.com/reports/1784162

Patch:
https://github.com/nextcloud/server/pull/40766

Comment 1 Andrea Mattiazzo 2024-01-19 09:04:38 UTC

Tracking as affected:
- openSUSE:Backports:SLE-15-SP4/nextcloud  23.0.5
- openSUSE:Backports:SLE-15-SP5/nextcloud  24.0.8

Comment 2 Eric Schirra 2024-01-19 10:39:22 UTC

Since Leap 15.6 is still beta or even alpha, I think we should bring version 28.0.1 from server:php:applications to Leap 15.6.

I can't help with the SLES because I don't have the rights.

You also have to be careful when updating. Always step by step.

The specified versions in SLEs are EOL
https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule

Comment 3 Eric Schirra 2024-04-16 07:58:17 UTC

Whats going on.
Can i close?