CVE-2025-66513

Executive Summary

CVE-2025-66513 is an information disclosure vulnerability in Nextcloud Tables, a collaborative table management application for the Nextcloud ecosystem. The flaw allows authenticated users with low privileges to enumerate the sharing configuration of tables, specifically which groups or users a table (identified by its numeric ID) is shared with, along with the associated permissions. This information should be restricted to privileged users (e.g., table owners or admins). The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating a low probability of exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available. Patches are available in versions 0.8.9, 0.9.6, and 1.0.1.

Supply Chain & Package Security

This vulnerability affects the Nextcloud Tables application, which is distributed as a PHP application within the Nextcloud ecosystem. It is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is limited to the Nextcloud app store and manual updates. Users should ensure they update the Tables app from the official Nextcloud app store or via their Nextcloud instance's app management interface.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid Nextcloud account with access to the Tables app.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure (sharing metadata).
• Integrity (I): None (N) – No data integrity impact.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires authentication but exposes sensitive metadata about table sharing configurations, which could be used for reconnaissance or privilege escalation planning.

Deep Dive & Mechanics

The Nextcloud Tables application allows users to create custom tables with individual columns and share them with other users or groups. The sharing mechanism includes permissions (e.g., read, write, manage). The vulnerability lies in the API endpoint that returns sharing information for a given table. Prior to the fix, this endpoint did not properly enforce authorization checks. Any authenticated user could query the sharing configuration of any table by its numeric ID, regardless of whether they were the owner or had manage permissions.

The affected API endpoint likely returns a JSON response containing:

• The list of users and groups the table is shared with.
• The permissions assigned to each user/group.

An attacker could enumerate table IDs (e.g., by iterating through numeric IDs) and extract this information, potentially identifying high-value tables or users with elevated permissions.

Vulnerable vs. Patched Code

The vulnerability is a missing authorization check. In the vulnerable code, the API endpoint for retrieving sharing information likely did not verify that the requesting user had the necessary permissions (e.g., manage or admin) to view the sharing configuration.

Vulnerable Code (Conceptual):

// Vulnerable: No permission check
public function getShares($tableId) {
    $shares = $this->shareManager->getSharesForTable($tableId);
    return new JSONResponse($shares);
}

Patched Code (Conceptual):

// Patched: Permission check added
public function getShares($tableId) {
    $table = $this->tableManager->getTable($tableId);
    if (!$this->shareManager->hasManagePermission($table, $this->userId)) {
        throw new NoPermissionException('You do not have permission to view shares.');
    }
    $shares = $this->shareManager->getSharesForTable($tableId);
    return new JSONResponse($shares);
}

The patch ensures that only users with manage permission (or admin) can view the sharing configuration.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Nextcloud instance with the Tables app installed (version < 0.8.9, < 0.9.6, or < 1.0.1).
• A valid user account with access to the Tables app.

Exploitation Steps:

1. Authenticate to the Nextcloud instance and obtain a session token.
2. Enumerate table IDs by sending requests to the API endpoint:

   GET /apps/tables/api/1/tables/{tableId}/shares
   

3. For each table ID, check the response. If the response contains sharing information (users, groups, permissions), the table is vulnerable.
4. Collect the data for reconnaissance.

Example cURL command:

curl -X GET "https://nextcloud.example.com/apps/tables/api/1/tables/1/shares" \
  -H "Authorization: Bearer <token>"

Blue Team

Detection:

• Monitor API logs for repeated requests to /apps/tables/api/1/tables/*/shares from non-admin users.
• Look for patterns of sequential table ID enumeration (e.g., 1, 2, 3, ...).

Mitigation:

• Immediately update the Tables app to version 0.8.9, 0.9.6, or 1.0.1.
• If patching is not possible, restrict access to the Tables app API using a Web Application Firewall (WAF) or reverse proxy rules.
• Review access logs for any suspicious activity related to table sharing enumeration.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /apps/tables/api/1/tables/*/shares with a 200 OK response for tables the user does not own.
• Logs: Nextcloud audit logs showing access to the getShares endpoint by users without manage permissions.
• File System: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule Detect_Nextcloud_Tables_Sharing_Enumeration {
    meta:
        description = "Detects attempts to enumerate table sharing configurations in Nextcloud Tables"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66513"
    strings:
        $api_path = "/apps/tables/api/1/tables/"
        $shares = "/shares"
    condition:
        $api_path and $shares
}

Sigma Rule

title: Nextcloud Tables Sharing Enumeration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects enumeration of table sharing configurations in Nextcloud Tables (CVE-2025-66513)
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: nextcloud
detection:
    selection:
        cs-uri-query|contains: "/apps/tables/api/1/tables/"
        cs-uri-query|contains: "/shares"
    condition: selection
falsepositives:
    - Legitimate table owners checking shares
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66513 Nextcloud Tables Sharing Enumeration";
    flow:to_server,established;
    content:"/apps/tables/api/1/tables/"; http_uri;
    content:"/shares"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the Nextcloud Tables app to version 0.8.9, 0.9.6, or 1.0.1.
2. If immediate patching is not possible, restrict access to the Tables API using a WAF or reverse proxy.

Long-Term Measures:

• Implement regular security audits of Nextcloud apps.
• Enforce the principle of least privilege for all API endpoints.
• Monitor for unusual API access patterns.

Workarounds:

• Disable the Tables app temporarily if it is not critical.
• Use IP whitelisting to restrict access to the Nextcloud instance.

Report generated by Valters IT DevSecOps & CTI Expert System