CVE-2021-41177 Rate-limits not working on instances without configured memory cache backend

What is CVE-2021-41177?

CVE-2021-41177 is a high-severity vulnerability in Nextcloud Nextcloud Server, published on 25 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.

Weakness: CWE-799

Which versions are affected by CVE-2021-41177?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2021-41177?

Upgrade to a fixed version.

Is CVE-2021-41177 being exploited?

There is no known exploitation of CVE-2021-41177 in the wild and no public exploit code.

Other vulnerabilities in Nextcloud Nextcloud Server

• CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server Critical 9.3
• CVE-2023-26482 Scope of workflow operations is not validated in nextcloud server Critical 9.1
• CVE-2018-3775 Auth bypass in Nextcloud Server High 8.8
• CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected High 8.7
• CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended High 8.7

All Nextcloud Nextcloud Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fj39-4qx4-m3f2.