CVE-2019-15622

Vulnerability

The Nextcloud Android app version 3.6.0 did not properly sanitize user input when processing custom queries. The insufficient sanitization allowed an attacker to access content information from protected database tables that should not have been exposed through the query interface. This vulnerability affects Nextcloud Android app 3.6.0 as disclosed in the official advisory [1].

Exploitation

An attacker with the ability to supply custom queries to the Nextcloud Android app (e.g., through a malicious app with query injection capabilities or by modifying network requests) can craft queries that bypass the intended access controls. No authentication beyond normal app usage is required if the attacker can inject the custom query. The attacker does not need elevated privileges on the device itself.

Impact

Successful exploitation leads to unauthorized disclosure of information from protected database tables. This constitutes a confidentiality breach, as the attacker can retrieve content that is normally restricted. The impact is limited to information disclosure; the attacker does not gain code execution or write access.

Mitigation

The vulnerability is fixed in Nextcloud Android app version 3.6.1, which was released after the advisory [1]. Users should update to version 3.6.1 or later via the Google Play Store or other distribution channels. No workarounds are documented for this issue.