Docker-based lab reproducing CVE-2023-26482 (Nextcloud RCE) with automated exploit script for educational vulnerability analysis and exploitation workflow demonstration.
Next cloud
This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes.
The environment is intentionally vulnerable and must only be deployed in isolated test environments. Do not attempt to exploit systems without explicit authorization.
The goal of this project is to demonstrate vulnerability analysis, exploitation workflow, and mitigation strategies.
This lab reproduces CVE-2023-26482, a Missing Scope Validation vulnerability in Nextcloud Server that allows an authenticated user to create malicious workflows, leading to Remote Code Execution (RCE) if the "Workflow Script" app is installed.
requests libraryStart the environment:
docker-compose up -d
Run the setup script to install the vulnerable app and create a test user
workflow_scriptbash setup.sh
Note: This might take a few minutes as it waits for Nextcloud to fully initialization.
Install Python dependencies:
pip install -r requirements.txt
Run the exploit:
python exploit.py
This script will:
attacker.touch /tmp/pwned) when a file with MIME type text/plain is uploaded.Trigger the RCE:
http://localhost:8080 with attacker / AttackerPassword123!.test.txt).Check if the file /tmp/pwned exists in the container:
docker-compose exec app ls -l /tmp/pwned
Firstly let's begin with user credentials created for the lab, witheout admin permissions :
As you can see overhere, the user attacker doesn't have admin permissions :
Let's start the exploit.py file :
As you can see here, we just have to upload a random .txt file
Here we go ! :
This vulnerability (CVE-2023-26482) can be corrected by upgrading the Nextcloud Server to a fixed version (≥ 24.0.10 or ≥ 25.0.4).