Loading HuntDB...

Database resource exhaustion for logged-in users via sharee recommendations with circles

Medium
N
Nextcloud
Submitted None

Team Summary

Official summary from Nextcloud

Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wxx7-w5p4-7x4c

Reported by michag86

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption
## Summary: Registered users can generate massive database load ## Steps To Reproduce: 1. create 9 circles and 6 folders (circles * folder > 50) 2. share all created folders with all created circles 3. open an other folder and open the share tab, so the URI /ocs/v2.php/apps/files_sharing/api/v1/sharees_recommended is requested 4. this requests results in a loop that runs as long as the php value max_execution_time is set; the recommended value for this is 3600 seconds (1h) 5. a small number of these requests will stress even large servers Tested with Nextcloud 23.0.8 ## Impact Attacker slow down the system by generating a lot of database/cpu load.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$250.00

Submitted

Weakness

Uncontrolled Resource Consumption