Nextcloud user_oidc app is missing brute force protection

Vulnerability

The user_oidc app for Nextcloud versions prior to 1.3.2 lacks bruteforce protection, enabling an attacker to repeatedly attempt authentication without rate limiting or account lockout. This vulnerability is documented in the security advisory [1].

Exploitation

An attacker can exploit this by sending numerous login requests with different credentials until a successful authentication occurs. The attack requires only network access to the Nextcloud instance, no privileges, and no user interaction. The absence of bruteforce protection means the attacker can continue attempts indefinitely [1].

Impact

Successful exploitation allows an attacker to gain unauthorized access to a victim's account, potentially leading to full control over the user's data and actions. This compromises the confidentiality, integrity, and availability of the Nextcloud system [1].

Mitigation

The vulnerability is fixed in user_oidc version 1.3.2. Users should upgrade to this version or later. The fix was implemented in pull request #615, which added bruteforce protection [2]. No workarounds have been disclosed.