If you use Nextcloud for syncing files and automation, you probably appreciate its flexibility. For advanced scenarios, there’s a command-line tool called nextcloudcmd that helps you sync files without a graphical user interface—perfect for servers and scripts. But, between versions prior to 3.6.1, there was a serious bug hiding under the hood: CVE-2022-39334. In this post, I’ll break down what went wrong, show you what the risk looks like in practice, and tell you what to do about it.
What is CVE-2022-39334 All About?
Here’s the core issue in plain language: nextcloudcmd trusted bad TLS certificates. This meant that if someone on your network tried to fake your Nextcloud server—with a self-signed or totally untrusted certificate—nextcloudcmd wouldn’t notice. The client would send files, usernames, passwords, tokens, and who-knows-what, right over to the imposter. This whole problem is a classic *Man-in-the-Middle (MitM)* attack risk.
- CLI Only: This problem affects only nextcloudcmd, the command-line app. It does NOT affect the usual Nextcloud Desktop (the graphical client), your web browser, or the main Nextcloud server.
Digging Deeper: How It Happens
When you connect to a secure site (like your Nextcloud server) using HTTPS, your software should check that:
The server is actually who it claims to be.
An attacker on the same network can set up a fake server with a self-signed certificate. A good client will see the certificate isn't valid, say, “Hold up, this could be dangerous,” and stop.
But in vulnerable versions, nextcloudcmd basically shrugged and kept going.
Vulnerable Scenario Example
# This is your automation script using nextcloudcmd (prior to 3.6.1)
nextcloudcmd -u alice -p 'mypassword' /data https://nextcloud.example.com/remote.php/dav/files/alice/
If someone on your local network intercepts your DNS or ARP traffic and redirects nextcloud.example.com to their machine, they can present ANY certificate—even a totally untrusted, expired, or self-signed one. nextcloudcmd will send your files and plaintext password without hesitation.
openssl req -x509 -newkey rsa:4096 -sha256 -days 1 -nodes \
-keyout mitm.key -out mitm.crt -subj "/CN=nextcloud.example.com"
`bash
# (for testing purposes, edit /etc/hosts)
The client connects and sends full login details—no warnings, no errors.
This attack only works if the attacker is on the same network (LAN, Wi-Fi), or can reroute your traffic—classic LAN/MITM scenario.
Silent Attack: There’s no indication to the script or user that anything’s wrong.
If you use nextcloudcmd for automation (think: cron jobs, backups, sync scripts), you may never notice the exposure—machine accounts are juicy targets, and attackers love silent bugs.
Who Is NOT Affected?
The normal desktop Nextcloud sync client (the graphical app you install on your laptop/PC)? Safe.
The Nextcloud server itself? Safe.
Only nextcloudcmd versions prior to 3.6.1 are in danger.
How Was It Fixed?
In version 3.6.1, the Nextcloud team fixed the validation logic, so now bad certificates are properly rejected.
Release Note:
- Nextcloud Desktop 3.6.1 Changelog
You can also check the GitHub security advisory for details.
If you use nextcloudcmd for scripting, check your version
nextcloudcmd --version
If it’s earlier than 3.6.1, upgrade now
- On Debian/Ubuntu, get the latest from the Nextcloud Downloads page or update your package.
- For manual installs, download the latest binaries here.
2. Check Your Scripts
Look for any places you use nextcloudcmd, especially in automated cron jobs or headless servers.
3. Restrict Network Exposure
Don’t let untrusted users onto the same networks as your Nextcloud servers—or clients! Segment, firewall, and encrypt as much as you can.
4. Use Strong Auth and Limit Permissions
If possible, set up unique tokens for script automation, and lock down their access as much as you can. Change passwords if you think they might have been exposed.
References
- GitHub Security Advisory for CVE-2022-39334
- Nextcloud Desktop Release Notes
- Common Vulnerabilities and Exposures (CVE-2022-39334) in NVD
Summary
If you’re using Nextcloud’s CLI, this bug could have put your files and login at risk by allowing bad certificates to sneak past—making MITM easy. But the fix is out, so update immediately and check your automation!
Timeline
Published on: 11/25/2022 19:15:00 UTC
Last modified on: 03/06/2023 23:15:00 UTC