CVE-2024-52525: Nextcloud Server Information Disclosure

CVE-2024-52525 Overview

CVE-2024-52525 affects Nextcloud Server, a widely deployed self-hosted personal cloud platform. Under certain conditions, the server stored a user's password in cleartext within PHP session data. While session data is encrypted before being written to session storage such as Redis or disk, the in-memory representation exposed the plaintext credential. A malicious process with access to the PHP process memory could recover the user's password. The issue is tracked under CWE-312: Cleartext Storage of Sensitive Information. Nextcloud addressed the flaw in versions 28.0.12, 29.0.9, and 30.0.2.

Critical Impact
A local attacker with read access to PHP process memory can extract cleartext user passwords from session data, enabling account takeover and lateral movement.

Affected Products

Nextcloud Server versions prior to 28.0.12
Nextcloud Server versions prior to 29.0.9
Nextcloud Server (Enterprise) versions prior to 30.0.2

Discovery Timeline

2024-11-15 - CVE-2024-52525 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52525

Vulnerability Analysis

The vulnerability resides in the LoginCredentials\Store component located at lib/private/Authentication/LoginCredentials/Store.php. This component caches the authenticated user's credentials in the PHP session so downstream services (such as external storage or encryption modules) can reuse them during a request. Although the session envelope was encrypted at rest, the password was placed into the session array as a plaintext string prior to serialization. Any code path or diagnostic tool that inspected live PHP process memory could observe the cleartext value.

The fix introduces the OCP\Security\ICrypto service into the Store constructor, ensuring the password is symmetrically encrypted and decrypted on demand rather than kept as a plaintext string inside the in-memory session data structure.

Root Cause

The root cause is CWE-312: Cleartext Storage of Sensitive Information. The Store class received the raw credential and persisted it directly into ISession without applying the platform's cryptographic wrapper. The encryption layer applied at the session storage boundary was insufficient because credentials remained plaintext throughout the request lifetime in PHP memory.

Attack Vector

Exploitation requires access to the memory of the PHP worker process handling the victim's session. Practical attack scenarios include a co-tenant process on a shared host, a compromised low-privilege service running on the web server, a core dump left readable on disk, or a debugger attached to php-fpm. Once memory access is obtained, the attacker can scan session structures for the plaintext password string and reuse the credential across Nextcloud and any federated service that shares it.

php

// Security patch in lib/private/Authentication/LoginCredentials/Store.php
namespace OC\Authentication\LoginCredentials;

use Exception;
use OC\Authentication\Exceptions\PasswordlessTokenException;
use OC\Authentication\Token\IProvider;
use OCP\Authentication\Exceptions\CredentialsUnavailableException;
use OCP\Authentication\Exceptions\InvalidTokenException;
use OCP\Authentication\LoginCredentials\ICredentials;
use OCP\Authentication\LoginCredentials\IStore;
use OCP\ISession;
use OCP\Security\ICrypto; // added to encrypt/decrypt the stored password
use OCP\Session\Exceptions\SessionNotAvailableException;
use OCP\Util;
use Psr\Log\LoggerInterface;

// In lib/private/Server.php the Store is now constructed with the crypto service:
// $crypto = $c->get(ICrypto::class);
// return new Store($session, $logger, $crypto, $tokenProvider);

Source: Nextcloud commit d25a0a2

Detection Methods for CVE-2024-52525

Indicators of Compromise

Unexpected core dumps or debug artifacts from php-fpm or apache2 processes on Nextcloud hosts.
Presence of memory-reading utilities such as gcore, gdb, or /proc/<pid>/mem access by non-root or unexpected users.
Successful Nextcloud logins from new geolocations or user-agents shortly after suspicious host activity.
Redis or session storage access from accounts that do not belong to the Nextcloud service identity.

Detection Strategies

Inventory Nextcloud Server instances and flag any running versions below 28.0.12, 29.0.9, or 30.0.2.
Alert on any process attaching to php-fpm via ptrace or reading /proc/<pid>/mem outside maintenance windows.
Monitor filesystem write events that create core dumps in Nextcloud web root or /var/lib/php directories.
Correlate authentication logs with host-level process anomalies to catch credential reuse following memory access.

Monitoring Recommendations

Enable Linux audit rules for ptrace syscalls targeting web server and PHP-FPM worker processes.
Forward Nextcloud nextcloud.log and web server access logs to a centralized SIEM for cross-referencing with host telemetry.
Track privileged shell activity on Nextcloud servers, especially commands invoking memory dump tooling.

How to Mitigate CVE-2024-52525

Immediate Actions Required

Upgrade Nextcloud Server to version 28.0.12, 29.0.9, or 30.0.2 depending on your release branch.
Rotate credentials for all users who authenticated to affected instances, particularly administrators and shared service accounts.
Invalidate active Nextcloud sessions and app passwords after patching to force re-authentication with the fixed code path.
Review host access logs for signs of memory inspection or unauthorized process attachment prior to the upgrade.

Patch Information

The upstream fix is delivered in commit d25a0a2896a2a981939cacb8ee0d555feef22b3b and merged via pull request #48915. The patch injects OCP\Security\ICrypto into the LoginCredentials\Store class so the password is encrypted while held in session data. Full details are published in the Nextcloud GHSA-w7v5-mgxm-v6gm advisory.

Workarounds

No official workaround exists; upgrading to a fixed release is the only supported remediation.
Restrict shell and debugger access on Nextcloud hosts to a minimal set of administrators until the patch is applied.
Disable core dumps for php-fpm and web server processes by setting ulimit -c 0 and configuring kernel.core_pattern to a controlled location.
Enforce process isolation by running php-fpm under a dedicated user and applying AppArmor or SELinux confinement.

bash

# Debian/Ubuntu example: upgrade Nextcloud via the built-in updater then verify version
sudo -u www-data php /var/www/nextcloud/updater/updater.phar
sudo -u www-data php /var/www/nextcloud/occ upgrade
sudo -u www-data php /var/www/nextcloud/occ status | grep versionstring
# Expected: versionstring: 28.0.12, 29.0.9, or 30.0.2 (or later)

# Harden the host against memory-scraping while patching
echo 'kernel.yama.ptrace_scope = 2' | sudo tee /etc/sysctl.d/10-ptrace.conf
sudo sysctl --system
sudo systemctl restart php-fpm