📖 The Story

Behind every CVE, there's a story. This one was found at 2 AM on a cold winter night, fueled by a breakup mashup on loop. Read the full technical deep-dive, the emotional rollercoaster, and the zero-trust lessons learned:

🔗 Read the Full Blog Post Here (Link your blog post)

🎯 Vulnerability Overview

When processing JWT tokens received from ID4me identity providers, Nextcloud's user_oidc app processes the token payload using base64_decode() without verifying the cryptographic signature.

// Lines 248 - 252
[$header, $payload, $signature] = explode('.', $data['id_token']);
$plainHeaders  = json_decode(base64_decode($header), true);
$plainPayload  = json_decode(base64_decode($payload), true);
/** TODO: VALIATE SIGNATURE! */
$user = $this->manager->getOrCreate($plainPayload['sub'], ...);

• Vulnerability: Improper Verification of Cryptographic Signature (CWE-347)
• Attack Vector: alg: none JWT forging
• Impact: Complete Authentication Bypass ➡️ Admin Takeover

🚀 The Exploit Script

nextcloud_id4me_poc.py is a fully automated, weaponized framework.

✨ Features

• 🕵️‍♂️ Auto-Detect: Extracts CSRF tokens and checks ID4me endpoints.
• 🎭 Token Forger: Crafts malicious alg: none JWT tokens on the fly.
• 🖧 Local OIDC: Spins up a fake OIDC authority server.
• 🚇 Ngrok Tunneling: Automatically exposes the fake server to the target via pyngrok.
• 💀 Glitch Banner: Because aesthetics matter.

⚙️ Setup

# 1. Install dependencies
pip install requests pyngrok

# 2. Add your free Ngrok auth token
ngrok config add-authtoken <YOUR_NGROK_TOKEN>

💥 Usage

python nextcloud_id4me_poc.py <TARGET_URL> [--user <USERNAME>] [--port <PORT>]

🎬 Example Run

python nextcloud_id4me_poc.py https://target.lab --user admin

(You will see a glitchy hacker banner initialize, followed by the automated exploit flow and a final vulnerability report).

🔍 Reconnaissance (Shodan Dorks)

To identify potentially vulnerable Nextcloud instances that have the user_oidc application installed:

title:"Nextcloud" http.html:"user_oidc"
title:"Nextcloud" http.html:"id4me"
http.title:"Nextcloud" http.html:"/apps/user_oidc/"

Note: Having the app installed does not automatically mean the target is vulnerable.

⚠️ Legal Disclaimer

This PoC is provided for EDUCATIONAL AND AUTHORIZED SECURITY TESTING PURPOSES ONLY.

This script is intended for security researchers and bug bounty hunters to test systems they have explicit permission to audit. Any unauthorized use of this tool against systems you do not own or have explicit, documented permission to test is strictly prohibited and may violate local, state, and federal laws.

The author (CyberTechAjju) assumes no liability and is not responsible for any misuse or damage caused by this program.