CVE-2024-37312 (published 2024-06-14T15:15Z)

user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/nextcloud/user_oidc
commit_details: repo_url: https://github.com/nextcloud/user_oidc
author: Julien Veyssier
author_date: 2024-02-20 10:30:10+01:00
msg: prevent using ID4ME routes if ID4ME is disabled

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
repository: repo_url: https://github.com/nextcloud/user_oidc
repo_name: nextcloud/user_oidc
description: OIDC connect user backend for Nextcloud
repo_language: PHP
owner: nextcloud
file_changes: filename: Id4meController.php
change_type: ModificationType.MODIFY
diff: @@ -33,6 +33,7 @@ use OCA\UserOIDC\Db\Id4Me;
 use OCA\UserOIDC\Db\Id4MeMapper;
 use OCA\UserOIDC\Db\UserMapper;
 use OCA\UserOIDC\Helper\HttpClientHelper;
+use OCA\UserOIDC\Service\ID4MeService;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Db\MultipleObjectsReturnedException;
 use OCP\AppFramework\Http;
@@ -89,6 +90,8 @@ class Id4meController extends BaseOidcController {
 	private $crypto;
 	/** @var ITimeFactory */
 	private $timeFactory;
+	/** @var ID4MeService */
+	private $id4MeService;
 
 	public function __construct(
 		IRequest $request,
@@ -104,6 +107,7 @@ class Id4meController extends BaseOidcController {
 		IUserManager $userManager,
 		HttpClientHelper $clientHelper,
 		Id4MeMapper $id4MeMapper,
+		ID4MeService $id4MeService,
 		LoggerInterface $logger,
 		ICrypto $crypto
 	) {
@@ -122,6 +126,7 @@ class Id4meController extends BaseOidcController {
 		$this->logger = $logger;
 		$this->crypto = $crypto;
 		$this->timeFactory = $timeFactory;
+		$this->id4MeService = $id4MeService;
 	}
 
 	/**
@@ -130,6 +135,11 @@ class Id4meController extends BaseOidcController {
 	 * @UseSession
 	 */
 	public function showLogin() {
+		if (!$this->id4MeService->getID4ME()) {
+			$message = $this->l10n->t('ID4Me is disabled');
+			return $this->build403TemplateResponse($message, Http::STATUS_FORBIDDEN, [], false);
+		}
+
 		Util::addStyle(Application::APP_ID, 'id4me-login');
 		$response = new Http\TemplateResponse('user_oidc', 'id4me/login', [], 'guest');
 
@@ -150,6 +160,11 @@ class Id4meController extends BaseOidcController {
 	 * @return RedirectResponse|TemplateResponse
 	 */
 	public function login(string $domain) {
+		if (!$this->id4MeService->getID4ME()) {
+			$message = $this->l10n->t('ID4Me is disabled');
+			return $this->build403TemplateResponse($message, Http::STATUS_FORBIDDEN, [], false);
+		}
+
 		try {
 			$authorityName = $this->id4me->discover($domain);
 		} catch (InvalidOpenIdDomainException | OpenIdDnsRecordNotFoundException $e) {
@@ -219,6 +234,11 @@ class Id4meController extends BaseOidcController {
 	 * @throws \Exception
 	 */
 	public function code(string $state = '', string $code = '', string $scope = '') {
+		if (!$this->id4MeService->getID4ME()) {
+			$message = $this->l10n->t('ID4Me is disabled');
+			return $this->build403TemplateResponse($message, Http::STATUS_FORBIDDEN, [], false);
+		}
+
 		if ($this->session->get(self::STATE) !== $state) {
 			$this->logger->debug('state does not match');
 

programming_language: PHP