Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute)
该报告还没有中文解读。
原文摘录
摘自原文（16564 字符中的一小部分）
Summary: The Nextcloud Desktop Client automatically includes user credentials (Authorization header with username:password in Base64) when downloading files via the `directDownloadUrl` feature. A malicious Nextcloud server can exploit this by setting `directDownloadUrl` to an attacker-controlled …
原文中的代码
} else {
// We were provided a direct URL, use that one
qCInfo(lcPropagateDownload) << "directDownloadUrl given for " << _item->_file << _item->_directDownloadUrl;
if (!_item->_directDownloadCookies.isEmpty()) {
headers["Cookie"] = _item->_directDownloadCookies.toUtf8();
} …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @py0zz1 · 版权归作者与 Nextcloud 所有