CVE-2023-28646 App lockout in nextcloud Android app can be bypassed via thirdparty apps
An attacker with physical access can bypass the Nextcloud Android app lockout via third-party apps to view file metadata.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-28646?
CVE-2023-28646 is a medium-severity authentication bypass vulnerability in nextcloud security-advisories, published on 30 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to 3.24.1. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2023-28646?
1 open source package ship an affected version, including nextcloud. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nextcloud Bitnami | From 3.7.0 | 3.24.1 |
Products include Nextcloud Nextcloud.
How do I fix CVE-2023-28646?
Upgrade nextcloud to 3.24.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-28646 being exploited?
There is no known exploitation of CVE-2023-28646 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2019-5454 SQL injection in com.nextcloud.client
- CVE-2021-43863 SQL Injection in FileContentProvider (GHSL-2021-1007)
- CVE-2019-5450 Cross-site scripting in com.nextcloud.client
- CVE-2019-5455 Auth bypass in com.nextcloud.client
- CVE-2021-22905 Information disclosure in Nextcloud Android App (com.nextcloud.client)
Sources
Also known as BIT-nextcloud-2023-28646, GHSA-c3rf-94h6-vj8v.