CVE-2021-43863 SQL Injection in FileContentProvider (GHSL-2021-1007)
Malicious apps on the same device can exploit SQL injection to access Nextcloud data, bypassing permission controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43863?
CVE-2021-43863 is a high-severity SQL injection vulnerability in nextcloud android, published on 25 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading.
Weakness: CWE-89
Which versions are affected by CVE-2021-43863?
1 open source package ship an affected version, including nextcloud. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nextcloud Bitnami | All versions | 3.18.1 |
Products include Nextcloud Nextcloud.
How do I fix CVE-2021-43863?
Upgrade nextcloud to 3.18.1 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-43863 being exploited?
There is no known exploitation of CVE-2021-43863 in the wild and no public exploit code.
Other vulnerabilities in nextcloud android
- CVE-2019-5454 SQL injection in com.nextcloud.client
- CVE-2019-5450 Cross-site scripting in com.nextcloud.client
- CVE-2019-5455 Auth bypass in com.nextcloud.client
- CVE-2021-22905 Information disclosure in Nextcloud Android App (com.nextcloud.client)
- CVE-2021-22912 Information disclosure in Nextcloud iOS app (it.twsweb.Nextcloud)
Sources
Also known as BIT-nextcloud-2021-43863, GHSA-vjp2-f63v-w479.