CVE-2022-31014 - SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server

Back Back to CVE browser

MEDIUM

SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server

Published Jul 5, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 2.51%

Description

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, but newlines should be sanitized to mitigate such arbitrary SMTP command injection. It is recommended that the Nextcloud Server is upgraded to 22.2.8 , 23.0.5 or 24.0.1. There are no known workarounds for this issue.

Affected products

Vendor Nextcloud Product Security-Advisories Default
n/a
- Version
  < 22.2.8
  Status
  affected
  Constraints
  -
- Version
  >= 23.0.0, < 23.0.5
  Status
  affected
  Constraints
  -
- Version
  >= 24.0.0, < 24.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nextcloud

Security-Advisories

n/a

Version	Status	Constraints
< 22.2.8	affected	-
>= 23.0.0, < 23.0.5	affected	-
>= 24.0.0, < 24.0.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-93

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52717
Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-264h-3v4w-6xh2
x_refsource_CONFIRMExploitThird Party Advisory
https://github.com/nextcloud/server/pull/32428
x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://hackerone.com/reports/1516377
x_refsource_MISCExploitIssue TrackingPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52717		Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-264h-3v4w-6xh2		x_refsource_CONFIRMExploitThird Party Advisory
https://github.com/nextcloud/server/pull/32428		x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://hackerone.com/reports/1516377		x_refsource_MISCExploitIssue TrackingPatchThird Party Advisory