PT-2021-21739 · Nextcloud · Nextcloud Desktop Client

Ameenbasha111 · Published 2021-08-18 · Updated 2022-10-25 · CVE-2021-37617

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client versions 3.0.3 through 3.2.4

Description The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Client invokes its uninstaller script when being installed to ensure no remnants of previous installations exist. In the affected versions, the Client searches for the Uninstall.exe file in a folder that can be written by regular users. This could allow a malicious user to create a malicious Uninstall.exe, which would be executed with administrative privileges during the Nextcloud Desktop Client installation.

Recommendations For Nextcloud Desktop Client versions 3.0.3 through 3.2.4, update to version 3.3.0 to resolve the issue. As a temporary workaround, do not allow untrusted users to create content in the C: system folder and verify that there is no malicious C:Uninstall.exe file on the system.

Fix

Uncontrolled Search Path Element

Untrusted Search Path

Weakness Enumeration

CWE-427

CWE-426

Related Identifiers

CVE-2021-37617

GHSA-6Q2W-V879-Q24V

Affected Products

Nextcloud Desktop Client

References · 8

• https://github.com/nextcloud/desktop/pull/3497 · Patch
• https://osv.dev/vulnerability/CVE-2021-37617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37617 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q2w-v879-q24v · Note
• https://hackerone.com/reports/1240749 · Note
• https://t.me/cvenotify/19657 · Telegram Post
• https://t.me/cibsecurity/27561 · Telegram Post
• https://t.me/cvenotify/19995 · Telegram Post