Blind SSRF in the Nextcloud Mail app on avatar endpoint

Vulnerability

The Nextcloud Mail app version prior to 3.0.2, 2.2.5, and 1.15.3 is vulnerable to a blind server-side request forgery (SSRF) in the avatar endpoint. The app fails to properly validate hostnames when fetching favicons, allowing an attacker to trigger GET requests to arbitrary internal services [1][2].

Exploitation

An attacker with access to the Nextcloud Mail app (e.g., an authenticated user) can craft a malicious email or configure an account to include a crafted avatar URL. The lack of host validation causes the server to make a GET request to the attacker-specified host [2]. No additional privileges beyond basic user access are required, though user interaction may be needed to open the email or view the avatar.

Impact

Successful exploitation allows an attacker to send blind GET requests to services running on the same web server or internal network. This can be used to probe internal services, potentially leading to information disclosure or triggering actions on vulnerable internal endpoints [2].

Mitigation

Update the Nextcloud Mail app to version 3.0.2, 2.2.5, or 1.15.3 [1][2]. No workarounds are currently available. The fix is implemented in pull request #8275, which adds validation for favicon hosts [1].