CVE-2024-46958: Nextcloud Desktop Information Disclosure

CVE-2024-46958 Overview

CVE-2024-46958 is an insecure permissions vulnerability affecting Nextcloud Desktop Client versions 3.13.1 through 3.13.3 on Linux systems. The vulnerability causes synchronized files between the Nextcloud server and client to potentially become world writable or world readable, exposing sensitive data to unauthorized local users and allowing malicious modification of synchronized content.

Critical Impact
Synchronized files may become accessible to any local user on the system, potentially exposing confidential data and allowing unauthorized file modifications that could propagate to the Nextcloud server and other connected clients.

Affected Products

Nextcloud Desktop Client versions 3.13.1 through 3.13.3
Linux operating systems running affected Nextcloud Desktop versions
All synchronized files managed by the vulnerable client versions

Discovery Timeline

2024-09-16 - CVE-2024-46958 published to NVD
2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-46958

Vulnerability Analysis

This vulnerability represents a file permission handling flaw in the Nextcloud Desktop Client's synchronization mechanism on Linux systems. When files are synchronized between the Nextcloud server and the local client, the application fails to properly set restrictive file permissions, resulting in files being created with world-readable (0644 or broader) or world-writable (0666 or broader) permissions instead of the expected user-only permissions.

The impact of this vulnerability is significant for multi-user Linux environments where multiple users share the same system. Any local user could potentially read confidential synchronized documents, and in cases where files become world-writable, malicious users could modify synchronized content. These modifications would then propagate back to the Nextcloud server and subsequently to all other connected clients, potentially enabling supply chain-style attacks within an organization's file sharing infrastructure.

Root Cause

The root cause lies in improper file permission handling during the file synchronization process. According to the related GitHub issues and pull requests, the Nextcloud Desktop Client failed to properly preserve or set appropriate Unix file permissions when creating or updating synchronized files on Linux systems. This likely stems from missing umask handling or incorrect chmod operations during the file write process, causing newly synchronized files to inherit overly permissive default permissions rather than restricting access to the owning user.

Attack Vector

The attack vector for this vulnerability is primarily local, despite the network-accessible nature of the synchronization service. An attacker with local system access on an affected Linux machine could exploit this vulnerability through the following mechanism:

The attacker identifies a system running Nextcloud Desktop Client versions 3.13.1-3.13.3
The attacker enumerates world-readable synchronized files to access sensitive documents
If files are world-writable, the attacker modifies synchronized content
Modified files propagate to the Nextcloud server and subsequently to all connected clients

The vulnerability does not require authentication to the Nextcloud service itself—only local access to the Linux system where the vulnerable client is installed. This makes it particularly dangerous in shared computing environments such as university systems, development servers, or multi-user workstations.

Detection Methods for CVE-2024-46958

Indicators of Compromise

Files within Nextcloud synchronization directories showing world-readable (o+r) or world-writable (o+w) permissions
Unexpected file permission changes in synchronized directories following sync operations
Unauthorized access logs showing local users accessing files in other users' Nextcloud sync folders
Audit trail anomalies indicating file modifications by users who should not have write access

Detection Strategies

Run periodic permission audits using find ~/Nextcloud -perm -o+r -type f to identify world-readable synchronized files
Monitor Nextcloud Desktop Client version across endpoints to identify systems running vulnerable versions 3.13.1-3.13.3
Deploy file integrity monitoring solutions to detect unexpected permission changes on synchronized directories
Review system audit logs for access to files in Nextcloud synchronization directories by unauthorized local users

Monitoring Recommendations

Implement automated version checking for Nextcloud Desktop Client installations across the Linux fleet
Configure file access auditing (auditd) on Nextcloud synchronization directories to track access patterns
Set up alerts for permission changes on files within user synchronization directories
Monitor for bulk file permission anomalies that could indicate exploitation or post-exploitation activity

How to Mitigate CVE-2024-46958

Immediate Actions Required

Upgrade Nextcloud Desktop Client to version 3.13.4 or later immediately on all affected Linux systems
Audit existing synchronized files for overly permissive permissions and remediate using chmod
Review file access logs for signs of unauthorized access during the exposure window
Notify users who may have had sensitive files exposed due to this vulnerability

Patch Information

Nextcloud has addressed this vulnerability in Desktop Client version 3.13.4. The fix ensures proper file permission handling during synchronization operations on Linux systems. Organizations should prioritize upgrading all affected installations. The Nextcloud Desktop Version Comparison and Nextcloud Desktop Pull Request #7092 provide detailed information about the changes implemented in the fix.

Workarounds

Manually correct file permissions on synchronized directories using restrictive umask settings
Implement a cron job to periodically reset permissions on Nextcloud sync directories: chmod -R go-rwx ~/Nextcloud
Restrict local system access to only trusted users until patching is complete
Consider temporarily disabling synchronization on shared multi-user systems until the upgrade can be performed

bash

# Remediate existing file permissions
find ~/Nextcloud -type f -exec chmod 600 {} \;
find ~/Nextcloud -type d -exec chmod 700 {} \;

# Verify no world-accessible files remain
find ~/Nextcloud -perm -o+r -o -perm -o+w