CVE-2021-22905

Vulnerability

The Nextcloud Android App (com.nextcloud.client) before version 3.16.0 performs searches for sharees (users or groups to share with) on the Nextcloud lookup server by default, rather than only querying the local Nextcloud server. This behavior occurs unless the user has explicitly chosen a global search. The affected versions are all releases prior to 3.16.0 [1].

Exploitation

An attacker does not need special network position or authentication beyond what is already present. When a user performs a sharee search in the app, the search query is sent to the Nextcloud lookup server without the user's explicit consent. The lookup server operator (or any party with access to the server's logs or network traffic) can observe the search terms, which may include internal usernames, email addresses, or other identifiers [1].

Impact

Successful exploitation results in information disclosure: the attacker gains knowledge of the search queries made by the user. This breaks the user's expectation that searches are confined to the local Nextcloud server, potentially revealing sensitive information about the organization's user directory or sharing patterns [1].

Mitigation

The vulnerability is fixed in Nextcloud Android App version 3.16.0. Users should upgrade to this version or later. No workarounds are available [1].