PT-2017-10154 · Owncloud+1 · Owncloud Server+1

Dwight Hohnstein · Published 2017-03-28 · Updated 2019-10-09 · CVE-2016-9463

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server versions prior to 10.0.1 ownCloud Server versions prior to 9.1.2 ownCloud Server versions prior to 9.0.6 ownCloud Server versions prior to 8.2.9

Description The issue allows an unauthenticated attacker to gain access to an account without valid credentials by exploiting the SMB user authentication bypass in the SMB authentication component. This component is optional and not enabled by default, requiring manual configuration in the config file. The problem arises because the backend does not properly handle SMB servers with anonymous authentication configured, which is the default setting for most SMB servers.

Recommendations For Nextcloud Server versions prior to 9.0.54, update to version 9.0.54 or later. For Nextcloud Server versions prior to 10.0.1, update to version 10.0.1 or later. For ownCloud Server versions prior to 9.1.2, update to version 9.1.2 or later. For ownCloud Server versions prior to 9.0.6, update to version 9.0.6 or later. For ownCloud Server versions prior to 8.2.9, update to version 8.2.9 or later. As a temporary workaround, consider disabling the SMB backend until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-303

Related Identifiers

CVE-2016-9463

Affected Products

Nextcloud Server

Owncloud Server

References · 12

• 🔥 https://hackerone.com/reports/148151 · Exploit
• 🔥 https://rhinosecuritylabs.com/2016/10/operation-ownedcloud-exploitation-post-exploitation-persistence · Exploit
• https://github.com/owncloud/apps/commit/5d47e7b52646cf79edadd78ce10c754290cbb732 · Patch
• https://github.com/owncloud/apps/commit/a0e07b7ddd5a5fd850a6e07f8457d05b76a300b3 · Patch
• https://github.com/owncloud/apps/commit/16cbccfc946c8711721fa684d78135ca1fb64791 · Patch
• https://github.com/nextcloud/apps/commit/b85ace6840b8a6704641086bc3b8eb8e81cb2274 · Patch
• https://github.com/nextcloud/apps/commit/decb91fd31f4ffab191cbf09ce4e5c55c67a4087 · Patch
• https://nextcloud.com/security/advisory/?id=nc-sa-2016-006 · Vendor Advisory
• https://owncloud.org/security/advisory/?id=oc-sa-2016-017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9463 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9463 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9463 · Note