SQL Injection in FileContentProvider (GHSL-2021-1007)

Vulnerability

The Nextcloud Android app, versions prior to 3.18.1, contains two security issues in its content providers. The FileContentProvider has an SQL injection vulnerability (GHSL-2021-1007) where user-supplied input is not properly sanitized before being used in SQL queries. The DiskLruImageCacheFileProvider has insufficient permission control, allowing access without proper authorization [1][2].

Exploitation

An attacker requires a malicious app installed on the same device as the Nextcloud Android app. No additional network access or authentication is needed because the attack is local. The malicious app can exploit the SQL injection in FileContentProvider by crafting content provider queries with malicious SQL, or directly access files through DiskLruImageCacheFileProvider due to the insufficient permission check [1][2].

Impact

Successful exploitation allows a malicious app to bypass Nextcloud's permission control system and access Nextcloud data stored on the device. This can lead to unauthorized disclosure of files, metadata, and other sensitive information stored in the Nextcloud app's local storage [2].

Mitigation

Users should upgrade to Nextcloud Android app version 3.18.1 or later, which was released on 2022-01-25 and contains the fixes for both issues [2]. The fix includes input validation in FileContentProvider to prevent SQL injection and proper permission checks in DiskLruImageCacheFileProvider. No workarounds are available; upgrading is the only mitigation [1][2].