CVE-2023-49792 Bruteforce protection can be bypassed with misconfigured proxy

Medium 5.3 Published 22 Dec 2023 Updated 27 Aug 2024

Attackers can bypass brute-force protection in Nextcloud Server when a reverse proxy is misconfigured, allowing excessive authentication attempts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-49792?

CVE-2023-49792 is a medium-severity vulnerability in Nextcloud Nextcloud Server, published on 22 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Weakness: CWE-307

Which versions are affected by CVE-2023-49792?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2023-49792?

No fix has been published for CVE-2023-49792 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-49792 being exploited?

There is no known exploitation of CVE-2023-49792 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-5j2p-q736-hw98.