Bug 2172792 (CVE-2023-25579) - CVE-2023-25579 nextcloud: potential directory traversal in OC\Files\Node\Folder::getFullPath
Summary: CVE-2023-25579 nextcloud: potential directory traversal in OC\Files\Node\Fold...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2023-25579
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2172793 2172794
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-02-23 06:09 UTC by Dhananjay Arunesh
Modified: 2023-02-23 22:29 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
the 'OC\Files\Node\Folder::getFullPath()' function was validating and normalizing the string in the wrong order. The function is used in the 'newFile()' and 'newFolder()' items, which may allow to creation of paths outside of ones own space and overwriting data from other users with crafted paths.
Clone Of:
Environment:
Last Closed: 2023-02-23 11:35:28 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2023-02-23 06:09:38 UTC 
Nextcloud server is a self hosted home cloud product. In affected versions the 'OC\Files\Node\Folder::getFullPath()' function was validating and normalizing the string in the wrong order. The function is used in the 'newFile()' and 'newFolder()' items, which may allow to creation of paths outside of ones own space and overwriting data from other users with crafted paths. This issue has been addressed in versions 25.0.2, 24.0.8, and 23.0.12. Users are advised to upgrade. There are no known workarounds for this issue.

References:
https://github.com/nextcloud/server/pull/35074
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-273v-9h7x-p68v
Comment 1 Dhananjay Arunesh 2023-02-23 06:10:06 UTC 
Created nextcloud tracking bugs for this issue:

Affects: epel-all [bug 2172794]
Affects: fedora-all [bug 2172793]
Comment 2 Product Security DevOps Team 2023-02-23 11:35:26 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
Note You need to log in before you can comment on or make changes to this bug.