PoC---CVE-2023-26482-RCE-LAB-Nextcloud

Next cloud

Proof of Concept & Analysis

Security Notice

This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes.

The environment is intentionally vulnerable and must only be deployed in isolated test environments. Do not attempt to exploit systems without explicit authorization.

The goal of this project is to demonstrate vulnerability analysis, exploitation workflow, and mitigation strategies.

This lab reproduces CVE-2023-26482, a Missing Scope Validation vulnerability in Nextcloud Server that allows an authenticated user to create malicious workflows, leading to Remote Code Execution (RCE) if the "Workflow Script" app is installed.

Prerequisites

• Docker & Docker Compose
• Python 3
• requests library

Setup

1. Start the environment:

   root@kitploit:~

   docker-compose up -d
   

2. Configure the instance (Automated): Run the setup script to install the vulnerable workflow_script app and create a test user

   root@kitploit:~

   bash setup.sh
   

   Note: This might take a few minutes as it waits for Nextcloud to fully initialization.

3. Install Python dependencies:

   root@kitploit:~

   pip install -r requirements.txt
   

Exploitation

1. Run the exploit:

   root@kitploit:~

   python exploit.py
   

   This script will:

   • Log in as attacker.
   • Create a Global/Admin workflow rule (which should be forbidden) to execute a command (touch /tmp/pwned) when a file with MIME type text/plain is uploaded.

2. Trigger the RCE:

   • Log in to http://localhost:8080 with attacker / AttackerPassword123!.
   • Upload a text file (e.g., test.txt).
   • The command should execute in the container.

Verification

Check if the file /tmp/pwned exists in the container:

docker-compose exec app ls -l /tmp/pwned

Demonstration

Firstly let's begin with user credentials created for the lab, witheout admin permissions :

As you can see overhere, the user attacker doesn't have admin permissions :

Let's start the exploit.py file :

As you can see here, we just have to upload a random .txt file

Here we go ! :

Reference

https://nvd.nist.gov/vuln/detail/cve-2023-26482? https://app.opencve.io/cve/CVE-2023-26482?

This vulnerability (CVE-2023-26482) can be corrected by upgrading the Nextcloud Server to a fixed version (≥ 24.0.10 or ≥ 25.0.4).