^{CVE-2021-32680:}Nextcloud Server audit logging vulnerability fails to record share expiration date removal events

Overview

This vulnerability (CVE-2021-32680) affects the audit logging functionality in Nextcloud Server, a package responsible for data storage in Nextcloud environments. When users remove or unset expiration dates from shared resources, the system should record these actions in the audit logs, but fails to do so in the affected versions. This creates a blind spot in security monitoring and could potentially allow malicious actors to extend access to sensitive resources without detection. Organizations that rely on comprehensive audit trails for compliance or security monitoring purposes are particularly affected by this vulnerability.

Remediation

To remediate this vulnerability, administrators should upgrade Nextcloud Server to one of the following fixed versions:

• Version 19.0.13 or later (if running Nextcloud 19)
• Version 20.0.11 or later (if running Nextcloud 20)
• Version 21.0.3 or later (if running Nextcloud 21)

The fix has been implemented in these versions to ensure proper logging of share expiration date removal events. After upgrading, administrators should verify that audit logging is functioning correctly by testing the removal of share expiration dates and confirming these events appear in the audit logs.

References

1. GitHub Security Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppf
2. Patch details: https://github.com/nextcloud/server/pull/27024
3. HackerOne report: https://hackerone.com/reports/1200810
4. Fedora Security Advisory: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
5. Fedora Security Advisory: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
6. Gentoo Linux Security Advisory: https://security.gentoo.org/glsa/202208-17