Listen to this Post
In Nextcloud Desktop client versions before 3.16.5, a vulnerability exists in the manual file locking feature for end-to-end encrypted directories. When a user attempts to manually lock a file within such a directory, the client sends a locking request to the server. This request includes the file path to identify the target file. However, due to an oversight, the file path is transmitted without being encrypted, even though it resides in an end-to-end encrypted folder. End-to-end encryption is designed to protect both file contents and metadata from server access, but this flaw leaks the path. The client likely uses a WebDAV LOCK method or a similar API call to perform the locking operation. During this process, the path parameter is appended to the request in plaintext. The server receives the request and logs the activity, including the unencrypted file path. These logs are stored on the server and can be accessed by administrators. Consequently, server administrators can see the paths of files that users are locking, revealing directory structures and file names. This metadata exposure compromises the privacy assurances of end-to-end encryption. The vulnerability is specific to manual locking; automatic locking mechanisms might not be affected. The root cause is that the client’s locking module does not integrate with the encryption layer for path handling. When preparing the request, the client fails to encrypt the path before sending it. The fix in version 3.16.5 involves modifying the client to encrypt the path using the user’s encryption keys prior to transmission. After the fix, the server only receives encrypted paths, which are indecipherable without the keys. This ensures that no sensitive metadata is leaked in server logs.
Platform: Nextcloud Desktop
Version: < 3.16.5
Vulnerability: Information Disclosure
Severity: Medium
Date: 2025-12-05
Prediction: Patch 2025-12-05
What Undercode Say:
Analytics:
Check for locking requests in Nextcloud logs grep -i "lock" /var/log/nextcloud/.log Verify installed Nextcloud Desktop version nextcloud --version Update Nextcloud Desktop on Debian-based systems sudo apt update && sudo apt install nextcloud-desktop=3.16.5 Simulate a locking request (for testing) curl -X LOCK -H "Authorization: Bearer <token>" https://nextcloud.example.com/remote.php/dav/files/user/path/to/file
How Exploit:
Attackers with server log access can extract unencrypted file paths from locking requests.
Protection from this CVE:
Upgrade Nextcloud Desktop to version 3.16.5 or later.
Impact:
Information disclosure of encrypted directory structures to server administrators.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
