PT-2022-26113 · Nextcloud+1 · Nextcloud Desktop Client+1

Nickvergessen · Published 2022-11-11 · Updated 2022-11-16 · CVE-2022-41882

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client version 3.6.0

Description The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file share and has it synced locally or the virtual filesystem enabled and clicked a "nc://open/" link, it will open the default editor for the file type of the shared file, which on Windows can also sometimes mean that a file depending on the type, e.g. "vbs", is being executed.

Recommendations For Nextcloud Desktop Client version 3.6.0, it is recommended to upgrade to version 3.6.1. As a workaround, users can block the Nextcloud Desktop client 3.6.0 by setting the minimum.supported.desktop.version system config to 3.6.1 on the server. Another workaround would be to enforce shares to be accepted by setting the sharing.force share accept system config to true on the server.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-41882

GHSA-3W86-RM38-8W63

Affected Products

Debian

Nextcloud Desktop Client

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41882.json · Exploit
• https://github.com/nextcloud/server/pull/34559 · Patch
• https://github.com/nextcloud/desktop/pull/5039 · Patch
• https://osv.dev/vulnerability/CVE-2022-41882 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-41882 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41882 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41882 · Security Note
• https://ubuntu.com/security/CVE-2022-41882 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-41882 · Vendor Advisory
• https://github.com/nextcloud/desktop/releases/tag/v3.6.1 · Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3w86-rm38-8w63 · Note
• https://t.me/cvenotify/37556 · Telegram Post
• https://t.me/cibsecurity/52868 · Telegram Post