CVE-2021-41177

Rate-limits not working on instances without configured memory cache backend

Severity Score

8.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.

Nextcloud es una plataforma de productividad de código abierto y auto-alojada. En las versiones anteriores a 20.0.13, 21.0.5 y 22.2.0, Nextcloud Server no implementaba un backend de base de datos para fines de limitación de velocidad. Cualquier componente de Nextcloud que usara límites de velocidad (como "AnonRateThrottle" o "UserRateThrottle") no se limitaba por tanto en instancias que no tuvieran configurado un backend de caché de memoria. En el caso de una instalación por defecto, esto incluiría notablemente los límites de velocidad en los códigos de dos factores. Es recomendado actualizar el servidor Nextcloud a la versión 20.0.13, 21.0.5 o 22.2.0. Como solución, habilite un backend de caché de memoria en "config.php"

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-09-15 CVE Reserved
2021-10-25 CVE Published
2024-06-27 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-799: Improper Control of Interaction Frequency

CAPEC

References (3)

URL	Tag	Source
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fj39-4qx4-m3f2	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/nextcloud/server/pull/28728	2022-10-26

URL	Date	SRC
https://security.gentoo.org/glsa/202208-17	2022-10-26

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				< 20.0.13 Search vendor "Nextcloud" for product "Nextcloud Server" and version " < 20.0.13"		-		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				>= 21.0.0 < 21.0.5 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 21.0.0 < 21.0.5"		-		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				>= 22.0.0 < 22.2.0 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 22.0.0 < 22.2.0"		-		Affected