PT-2024-19394 · Nextcloud · Nextcloud Files Zip App

Nickvergessen · Published 2024-01-18 · Updated 2024-01-26 · CVE-2024-22404

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud files Zip app versions prior to 1.2.1 Nextcloud files Zip app versions prior to 1.4.1 Nextcloud files Zip app versions prior to 1.5.0

Description The Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions, users can download "view-only" files by zipping the complete folder.

Recommendations For versions prior to 1.2.1, upgrade to 1.2.1 or later. For versions prior to 1.4.1, upgrade to 1.4.1 or later. For versions prior to 1.5.0, upgrade to 1.5.0 or later. As a temporary workaround, consider disabling the file zip app until a patch is available.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-22404

GHSA-VHJ3-MCH4-67FQ

Affected Products

Nextcloud Files Zip App

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22404.json · Exploit
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq · Vendor Advisory
• https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820 · Patch
• https://osv.dev/vulnerability/CVE-2024-22404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22404 · Security Note
• https://twitter.com/CVEnew/status/1748082317111722352 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1748130639071613362 · Twitter Post
• https://hackerone.com/reports/2247457 · Note