Sensitive files/ data exists post deletion of user account
Low
N
Nextcloud
Submitted None
Team Summary
Official summary from Nextcloud
Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xcj9-3jch-qr2r
Actions:
Reported by
geekysherlock
Vulnerability Details
Technical details and impact analysis
In the latest android app ,I created an account in the name of [email protected].
After few activities,deleted the account .
Files containing user emails and tokens still exist.Relevant files not deleted upon deletion of account.
Content of files post deletion of account:
generic_x86:/data/data/com.nextcloud.client/shared_prefs # ls
FirebaseAppHeartBeat.xml WebViewChromiumPrefs.xml com.google.android.gms.appid.xml com.nextcloud.client_preferences.xml migrations.xml variant-emoji-manager.xml
generic_x86:/data/data/com.nextcloud.client/shared_prefs # cat com.nextcloud.client_preferences.xml
<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
<boolean name="keysMigration" value="true" />
<string name="select_oc_account">[email protected]@us.cloudamo.com</string>
<boolean name="autoUploadPathUpdate" value="true" />
<boolean name="autoUploadInit" value="true" />
<int name="prefs_uploader_behaviour" value="1" />
<boolean name="storagePathFix" value="true" />
<boolean name="autoUploadEntriesSplitOut" value="true" />
<boolean name="keysReinit" value="true" />
<string name="pushToken">euwTiu9CT3CvQNHqNVZPIk:APA91bHqkGjFhx-BiCEH_NcRnaEvrp21tbxvjOKhHrQ1mUTCW3Dp46X90YinSDcjfVXytTcT9CLQBcrOv5J_EfSGM7GbZrZAyeKC1xOtgNBLkFeo4_EqX7LqVW-ezuG_rou1y2Ux8ah5</string>
<float name="grid_columns" value="3.0" />
<string name="storage_path">/storage/emulated/0/Android/media/com.nextcloud.client</string>
<boolean name="legacyClean" value="true" />
<string name="upload_from_local_last_path">/storage/emulated/0/Pictures</string>
<int name="lastSeenVersionCode" value="30160190" />
</map>
Images folder
generic_x86:/data/data/com.nextcloud.client/shared_prefs # cd /storage/emulated/0/Pictures
generic_x86:/storage/emulated/0/Pictures # ls
2131099731.jpg 2131099732.jpg 2131099733.jpg
## Impact
This information could be misused as sensitive token related ,images,user related details exist inspite of user account being deleted.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$150.00
Submitted
Weakness
Improper Access Control - Generic