Share replacement via shared-mount cache key collision
Published Mar 30, 2023 · Updated Feb 11, 2025
Nextcloud Server 24.0.0 through 24.0.8 and 25.0.0 through 25.0.2 allows remote authenticated users to replace displayed shares. The shared-mount verification cache uses a key that collides for same-named shares, so the second mount is treated as the first instead of receiving a numbered name. The sender needs an account and a memory-cache-enabled instance, and the recipient must receive two identically named shares; the collision can hide the first folder or present attacker-controlled content under its name.
Summary
What happened
Nextcloud Server 24.0.0 through 24.0.8 and 25.0.0 through 25.0.2 allows remote authenticated users to replace displayed shares. The shared-mount verification cache uses a key that collides for same-named shares, so the second mount is treated as the first instead of receiving a numbered name. The sender needs an account and a memory-cache-enabled instance, and the recipient must receive two identically named shares; the collision can hide the first folder or present attacker-controlled content under its name.
The record
- CVE
- CVE-2023-28643
- Published
- Mar 30, 2023
- Updated
- Feb 11, 2025
- Vendor
- Nextcloud GmbH
- Product
- Security Advisories
- Classifications
- CWE-706, T1036.005
- Attack vector
- network
- Privileges
- authenticated
Timeline
How it unfolded
- Mar 30, 2023CVE publishedPublication date reported by the CVE source.
- Feb 11, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=< 24.0.9
- Affected versionversion=>= 25.0.0, < 25.0.3
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Same-name shared-folder collision reproductionproof of concept · unverified
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo