Nextcloud 35.0.0 — delegated Users admin can PUT-edit an LDAP-promoted admin that PATCH correctly refuses
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · nextcloud-ldap-put-isadmin
Nextcloud Server 35.0.0 - Nextcloud GmbH
PUT /cloud/users/{id} lets a delegated Users admin edit a target unless that target is in the local group admin. PATCH on the same path correctly uses isAdmin(). LDAP-promoted admins are isAdmin()===true and often not in that local group.
A bad actor with the helpdesk-style Users job can disable, quota-lock, or delete a real LDAP-promoted instance admin. The newer PATCH API correctly refuses. The older PUT path does not.
| ID | no CVE yet |
| CWE | CWE-863 |
| CVSS | High: 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (delegated Users admin, not instance admin) |
| Product | Nextcloud Server |
| Affected | 35.0.0 (da02f41) official nextcloud:35.0.0-apache plus user_ldap |
| Auth | delegated Users admin vs LDAP-promoted admin |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
On an LDAP site, you promoted an LDAP group to instance admin (occ ldap:promote-group). Those people are real admins (isAdmin()===true) but they may not sit in the local Nextcloud group named admin.
You also gave someone the Users settings job (helpdesk). They are not a full instance admin.
That helpdesk user can:
isInGroup gate on enable/disable/delete/wipe)canChangePassword() (often false; do not depend on it)They cannot do this to someone who is actually in the local admin group. They cannot do this on a site with no LDAP-promoted admins. The safer PATCH API already knows the difference.
Provisioning has two editors for the same user. UsersController::editUser is PUT. editUserMultiField is PATCH. Same file. Adjacent methods. Two different answers to "is this person an admin."
PUT checks isInGroup($target, 'admin'). PATCH checks isAdmin($target). Manager::isAdmin() asks LDAP IIsAdmin then the local group. occ ldap:promote-group makes an LDAP group instance-admin without putting those uids in the local admin group.
I stood up official nextcloud:35.0.0-apache plus osixia/openldap:1.5.0. LDAP user ldapadmin in promoted group ncadmins: isAdmin()===true, not in local admin. Local helpdesk is delegated Users, not instance admin.
I sent PATCH first. It is the newer route. I expected PUT to match it. PATCH {"quota":"1 GB"} returned 403. PUT key=quota&value=1 GB returned 200. GET then showed quota 1073741824.
cd lab
./run.sh
Target only http://127.0.0.1:18342 (OpenLDAP on compose DNS ldap:389).
SUCCESS NEXTCLOUD-LDAP-PUT-ISADMIN who=delegated-users-admin target=ldapadmin put=200 patch=403 NEXTCLOUD-LDAP-PUT-ISADMIN-WITNESS
Use isAdmin($target) on PUT/disable/delete/wipe the same way PATCH already does.
occ ldap:promote-group (PR #41650)GNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.