Blind SSRF via server URL input in the Nextcloud Mail app

Vulnerability

The Nextcloud Mail app (versions prior to 1.15.0 and 2.2.2) does not validate the host fields for SMTP, IMAP, and Sieve settings. An authenticated attacker can supply arbitrary hostnames or IP addresses, causing the server to attempt connections to those hosts. This leads to a blind Server-Side Request Forgery (SSRF) vulnerability, allowing the attacker to probe internal services reachable from the Nextcloud server [2]. The fix introduced in pull request #7796 adds host validation [1].

Exploitation

An attacker must be an authenticated Nextcloud user with the ability to configure mail accounts (e.g., via the Mail app settings). The attacker sets the SMTP, IMAP, or Sieve host field to an internal IP address or hostname (e.g., 127.0.0.1, 10.0.0.1, or a service name). When the Nextcloud server attempts to connect to the specified host, the attacker can infer the existence of internal services based on connection success, failure, or timing differences [2]. No user interaction beyond the initial configuration is required.

Impact

Successful exploitation results in blind SSRF, enabling the attacker to scan internal networks and services that are otherwise inaccessible from outside. This can lead to information disclosure about internal infrastructure, such as identifying running services or internal hostnames. The vulnerability does not directly allow code execution or data exfiltration, but it can be used as a stepping stone for further attacks [2].

Mitigation

The vulnerability is fixed in Nextcloud Mail versions 1.15.0 and 2.2.2 [2]. Users should upgrade to these versions or later. The only known workaround is to completely disable the Nextcloud Mail app until an upgrade can be applied [2]. No evidence of inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog was found in the available references.