Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders

Vulnerability

The vulnerability lies in the handling of end-to-end encryption (E2EE) metadata in Nextcloud clients. A malicious server administrator can supply crafted metadata that causes the client to fall back to an older, vulnerable metadata format, bypassing the authenticity checks. This affects Nextcloud Desktop client versions 3.0.0 to 3.8.0, Nextcloud Android app versions 3.13.0 to 3.25.0, and Nextcloud iOS app versions 3.0.5 to 4.8.0 [2].

Exploitation

An attacker with server administrator privileges can manipulate the metadata keys sent to the client during synchronization. The client, trusting the server, falls back to an older metadata format that the attacker can decrypt. No user interaction is required beyond the client syncing with the server [1][2].

Impact

Successful exploitation allows the attacker to decrypt all files in the E2EE folder, recover the folder structure, and add new encrypted files. This fully compromises the confidentiality and integrity of the end-to-end encrypted data [2].

Mitigation

The issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No workarounds are available; users must update to these versions or later [1][2].