PT-2024-27810 · Nextcloud · Nextcloud Desktop Client

Lourc0D3 · Published 2024-06-14 · Updated 2024-08-19 · CVE-2024-37885

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client versions prior to 3.12.0

Description A code injection issue in the Nextcloud Desktop Client for macOS allows arbitrary code to be loaded when the client is started with the DYLD INSERT LIBRARIES environment variable set. This issue affects the synchronization of files from Nextcloud Server with the user's computer.

Recommendations For versions prior to 3.12.0, upgrade the Nextcloud Desktop client to version 3.12.0 to resolve the issue. As a temporary workaround, consider restricting the use of the DYLD INSERT LIBRARIES environment variable until the upgrade is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-37885

GHSA-4MF7-V63M-99P7

Affected Products

Nextcloud Desktop Client

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37885.json · Exploit
• https://github.com/nextcloud/desktop/pull/6378 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v63m-99p7 · Patch
• https://osv.dev/vulnerability/CVE-2024-37885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37885 · Security Note
• https://twitter.com/linuxpatch/status/1801663212384833609 · Twitter Post
• https://hackerone.com/reports/2307625 · Note
• https://twitter.com/CVEnew/status/1801673782781952233 · Twitter Post