CVE-2024-22404 Permissions bypass in Nextcloud with the files zip app
Attackers can bypass view-only restrictions to download protected files by zipping folders in the Nextcloud Files Zip app.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-22404?
CVE-2024-22404 is a medium-severity missing authorization vulnerability in nextcloud security-advisories, published on 18 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.
Weakness: CWE-281
Which versions are affected by CVE-2024-22404?
It affects 1 product.
Products include Nextcloud Zipper.
How do I fix CVE-2024-22404?
No fix has been published for CVE-2024-22404 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-22404 being exploited?
There is no known exploitation of CVE-2024-22404 in the wild and no public exploit code.
Sources
Also known as GHSA-vhj3-mch4-67fq.