CVE-2022-31014

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, but newlines should be sanitized to mitigate such arbitrary SMTP command injection. It is recommended that the Nextcloud Server is upgraded to 22.2.8 , 23.0.5 or 24.0.1. There are no known workarounds for this issue.

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, but newlines should be sanitized to mitigate such arbitrary SMTP command injection. It is recommended that the Nextcloud Server is upgraded to 22.2.8 , 23.0.5 or 24.0.1. There are no known workarounds for this issue.

El servidor Nextcloud es un servidor de nube personal de código abierto. Se detectó que las versiones afectadas eran vulnerables a la inyección de comandos SMTP. El impacto varía según los comandos admitidos por el servidor SMTP de back-end. Sin embargo, el principal riesgo aquí es que el atacante puede secuestrar una sesión SMTP ya autenticada y ejecutar comandos SMTP arbitrarios como usuario de correo electrónico, como enviar correos electrónicos a otros usuarios, cambiar el usuario FROM, etc. Como antes, esto depende de la configuración del servidor en sí, pero las nuevas líneas deben ser saneadas para mitigar la inyección de comandos SMTP arbitrarios. Se recomienda que el servidor Nextcloud se actualice a versiones 22.2.8, 23.0.5 o 24.0.1. No se conocen mitigaciones adicionales para este problema