Bug 1218981 (CVE-2024-22403) - VUL-0: CVE-2024-22403: nextcloud: OAuth codes did not expire
Summary: VUL-0: CVE-2024-22403: nextcloud: OAuth codes did not expire
Status: NEW
Alias: CVE-2024-22403
Product: openSUSE Distribution
Classification: openSUSE
Component: Other (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Eric Schirra
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/391700/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-19 09:04 UTC by SMASH SMASH
Modified: 2024-04-16 07:58 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-01-19 09:04:05 UTC
Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22403
https://www.cve.org/CVERecord?id=CVE-2024-22403
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36
https://hackerone.com/reports/1784162

Patch:
https://github.com/nextcloud/server/pull/40766
Comment 1 Andrea Mattiazzo 2024-01-19 09:04:38 UTC
Tracking as affected:
- openSUSE:Backports:SLE-15-SP4/nextcloud  23.0.5
- openSUSE:Backports:SLE-15-SP5/nextcloud  24.0.8
Comment 2 Eric Schirra 2024-01-19 10:39:22 UTC
Since Leap 15.6 is still beta or even alpha, I think we should bring version 28.0.1 from server:php:applications to Leap 15.6.

I can't help with the SLES because I don't have the rights.

You also have to be careful when updating. Always step by step.

The specified versions in SLEs are EOL
https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule
Comment 3 Eric Schirra 2024-04-16 07:58:17 UTC
Whats going on.
Can i close?