Nexcloud Mail app temporarily stores cleartext password in database

Vulnerability

Nextcloud Mail versions prior to 2.2.2 temporarily stored user passwords in cleartext in the database during the OAuth2 setup procedure. The password was stored in the password field of the mail account configuration even when OAuth2 authentication was being configured, instead of leaving the field empty until the access token was obtained [1][2].

Exploitation

An attacker or malicious user with database access (e.g., via SQL injection or compromised database credentials) could read the cleartext passwords of users who were in the process of setting up an OAuth2 mail account. No special network position or user interaction beyond normal OAuth2 setup is required [1].

Impact

Successful exploitation results in disclosure of user passwords, compromising confidentiality. The attacker gains unauthorized access to the user's mail account credentials, potentially leading to further compromise of the email account and related services [1].

Mitigation

The vulnerability is fixed in Nextcloud Mail version 2.2.2, released on 2023-02-06. Users should upgrade to this version or later. There are no known workarounds for this issue [1].