Vulnerability · Published Feb 6, 2023 · Assigned by GitHub_M

CVE-2023-23943Blind SSRF via server URL input in the Nextcloud Mail app

Medium 5.0

In plain English

A medium-severity server-side request forgery in security-advisories from nextcloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.9%top 39.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 2.0.0, < 2.2.2< 1.15.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6 x_refsource_CONFIRM
https://github.com/nextcloud/mail/pull/7796 x_refsource_MISC
https://hackerone.com/reports/1736390 x_refsource_MISC
https://hackerone.com/reports/1741525 x_refsource_MISC
https://hackerone.com/reports/1746582 x_refsource_MISC