PT-2021-19888 · Nextcloud · Nextcloud Android Client

Rtod · Published 2021-07-12 · Updated 2021-07-14 · CVE-2021-32727

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Android Client versions prior to 3.16.1

Description The issue concerns the Nextcloud Android Client's handling of end-to-end encryption. When using this feature, clients download public and private keys via an API endpoint. In affected versions, the client fails to verify if a private key matches a previously downloaded public certificate. This could allow a malicious actor to serve a fake public key, enabling them to access encrypted data.

Recommendations For versions prior to 3.16.1, update to version 3.16.1 to resolve the issue. As a temporary workaround, do not add additional end-to-end encrypted devices to a user account.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2021-32727

GHSA-5V33-R9CM-7736

Affected Products

Nextcloud Android Client

References · 6

• https://osv.dev/vulnerability/CVE-2021-32727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32727 · Security Note
• https://github.com/nextcloud/android/pull/8438 · Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5v33-r9cm-7736 · Note
• https://github.com/nextcloud/end_to_end_encryption_rfc/blob/7f002996397faefb664019a97ebb0a1e210f64f0/RFC.md#further-devices · Note
• https://hackerone.com/reports/1189162 · Note