CVE-2021-41179 Two-Factor Authentication not enforced for pages marked as public
Attackers can bypass Two-Factor Authentication to access private chat channels in Nextcloud Talk by exploiting public page handling flaws.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41179?
CVE-2021-41179 is a medium-severity authentication bypass vulnerability in nextcloud security-advisories, published on 25 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.
Weakness: CWE-304
Which versions are affected by CVE-2021-41179?
It affects 1 product.
Products include Nextcloud Server.
How do I fix CVE-2021-41179?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-41179 being exploited?
There is no known exploitation of CVE-2021-41179 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
Sources
Also known as GHSA-7hvh-rc6f-px23.