CVE-2025-66515

Executive Summary

CVE-2025-66515 is a low-severity authorization bypass vulnerability in the Nextcloud Approval app (versions prior to 1.3.1 and 2.5.0). An authenticated user who is listed as a requester in a workflow can manipulate another user’s file into a “pending approval” state without having direct access to that file. The attack is performed by supplying the numeric file ID of the target file. This vulnerability does not allow data exfiltration or modification of file content, but it can disrupt workflows and cause denial-of-service conditions by forcing unwanted approval processes.

The CVSS score is 2.7 (Low), reflecting the requirement for authentication and the limited impact on integrity. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. No public proof-of-concept code or exploit templates are available at this time.

Supply Chain & Package Security

This vulnerability affects the Nextcloud Approval app, which is distributed through the Nextcloud App Store and can be installed via the Nextcloud web interface or command-line tools. The app is written in PHP and JavaScript. Users should ensure they are using a trusted source (the official Nextcloud App Store) and verify the integrity of the app package using the provided SHA-256 checksums. The Nextcloud ecosystem relies on Composer for PHP dependencies and npm for JavaScript dependencies; however, this specific vulnerability is in the application logic, not in a third-party package.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 2.7 (Low)
• Attack Vector (AV): Network (N) – The attack can be performed remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be an authenticated user with a requester role in a workflow.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): Low (L) – The attacker can change the approval state of a file, but not its content.
• Availability (A): None (N) – No direct impact on availability, though workflow disruption could be considered a minor availability issue.

Threat Level: Low. Exploitation requires authentication and a specific role. The impact is limited to workflow manipulation.

Deep Dive & Mechanics

The Nextcloud Approval app allows users to create workflows where files must be approved or disapproved. A workflow defines a requester (who submits the file for approval) and one or more approvers. The vulnerability lies in the API endpoint that handles the submission of a file for approval.

Root Cause: The application does not properly verify that the authenticated user has access to the file identified by the numeric file ID. Instead, it only checks that the user is listed as a requester in the workflow. An attacker can enumerate file IDs (which are sequential integers) and submit any file for approval, even if they do not have read or write permissions on that file.

Attack Flow:

1. The attacker authenticates to Nextcloud and obtains a valid session token.
2. The attacker identifies a target file ID (e.g., by guessing or observing file IDs in the system).
3. The attacker sends a POST request to the approval endpoint (e.g., /apps/approval/api/v1/workflows/{workflowId}/submit) with the target file ID in the request body.
4. The server processes the request and changes the file’s status to “pending approval” in the workflow, even though the attacker has no access to the file.

Impact: The attacker can cause unwanted approval requests, potentially disrupting business processes or causing confusion. For example, a sensitive document could be forced into an approval workflow, triggering notifications to approvers and potentially causing a denial-of-service condition if many files are submitted.

Vulnerable vs. Patched Code

The vulnerability is in the PHP backend of the Approval app. The vulnerable code likely resides in a controller or service class that handles the submission of files for approval.

Vulnerable Code (Conceptual):

// Vulnerable: No access check on the file
public function submitFileForApproval($workflowId, $fileId) {
    $workflow = $this->workflowRepository->find($workflowId);
    if (!$workflow || $workflow->getRequester() !== $this->user) {
        throw new \Exception('Not authorized');
    }
    $file = $this->fileRepository->find($fileId);
    // No check if $this->user has access to $file
    $this->approvalRepository->create($workflow, $file, $this->user);
}

Patched Code (Conceptual):

// Patched: Added access check using Nextcloud's file system
public function submitFileForApproval($workflowId, $fileId) {
    $workflow = $this->workflowRepository->find($workflowId);
    if (!$workflow || $workflow->getRequester() !== $this->user) {
        throw new \Exception('Not authorized');
    }
    $file = $this->fileRepository->find($fileId);
    // Check if the user has read access to the file
    if (!$this->fileSystem->isReadable($file->getPath(), $this->user)) {
        throw new \Exception('Access denied');
    }
    $this->approvalRepository->create($workflow, $file, $this->user);
}

The patch adds a call to isReadable() (or equivalent) to verify that the authenticated user has at least read access to the file before allowing the submission.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Nextcloud instance with the Approval app installed (version < 1.3.1 or < 2.5.0).
• An authenticated user account with a requester role in at least one workflow.
• Knowledge of a target file ID (e.g., file ID 42).

Exploitation Steps:

1. Obtain a valid session token for the attacker user.
2. Identify the workflow ID where the attacker is a requester (e.g., workflow ID 5).
3. Send a POST request to the approval endpoint:

curl -X POST \
  'https://nextcloud.example.com/apps/approval/api/v1/workflows/5/submit' \
  -H 'Authorization: Bearer <attacker_token>' \
  -H 'Content-Type: application/json' \
  -d '{"fileId": 42}'

4. The server responds with a success message, and the file with ID 42 is now in a “pending approval” state.

Expected Response:

{
  "status": "success",
  "data": {
    "approvalId": 123,
    "fileId": 42,
    "status": "pending"
  }
}

Blue Team

Detection:

• Monitor API logs for unusual patterns of file submissions, especially from users who do not normally interact with certain files.
• Look for multiple submissions from the same user to different file IDs in a short period.
• Alert on submissions where the file ID does not belong to the user’s accessible files.

Hunting:

• Query Nextcloud’s database for approval records where the requester does not have read access to the file:

  SELECT a.* FROM oc_approval a
  JOIN oc_filecache f ON a.file_id = f.fileid
  LEFT JOIN oc_share s ON f.fileid = s.file_source AND s.share_with = a.requester
  WHERE a.requester NOT IN (
    SELECT uid FROM oc_group_user WHERE gid IN (
      SELECT gid FROM oc_group_user WHERE uid = a.requester
    )
  );
  

  (Note: This is a simplified query; actual implementation may vary.)

Mitigation:

• Immediately update the Approval app to version 1.3.1 or 2.5.0.
• If immediate patching is not possible, consider disabling the Approval app temporarily.
• Implement additional monitoring and alerting for the approval submission endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /apps/approval/api/v1/workflows/*/submit with a fileId parameter that does not belong to the authenticated user.
  • Repeated requests with sequential or random file IDs from the same user.

• File IOCs:

  • Unusual approval records in the database where the requester does not have read access to the file.

• Log IOCs:

  • Nextcloud audit log entries showing approval submissions for files not owned or shared with the requester.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_66515_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66515 in Nextcloud Approval app"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66515"
        severity = "low"
    strings:
        $s1 = "/apps/approval/api/v1/workflows/" ascii wide nocase
        $s2 = "/submit" ascii wide nocase
        $s3 = "fileId" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: Nextcloud Approval App File ID Manipulation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-66515 by submitting a file for approval without proper access control.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66515
logsource:
    category: webserver
    product: nextcloud
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/apps/approval/api/v1/workflows/'
        cs-uri-query|contains: '/submit'
        cs-uri-query|contains: 'fileId'
    condition: selection
falsepositives:
    - Legitimate approval submissions by authorized users
level: low

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66515 Nextcloud Approval App File ID Manipulation";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/apps/approval/api/v1/workflows/";
    http_uri;
    content:"/submit";
    http_uri;
    content:"fileId";
    http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
    reference:cve,2025-66515;
)

Remediation & Mitigation

Immediate Actions:

1. Update the Approval app to version 1.3.1 (for the 1.x branch) or 2.5.0 (for the 2.x branch) via the Nextcloud App Store or command line:

   sudo -u www-data php occ app:update approval
   

2. Verify the update by checking the app version in the Nextcloud admin panel or via:

   sudo -u www-data php occ app:list | grep approval
   

Compensating Controls (if patching is delayed):

• Disable the Approval app temporarily:

  sudo -u www-data php occ app:disable approval
  

• Implement a Web Application Firewall (WAF) rule to block suspicious requests to the approval endpoint.
• Enable detailed audit logging in Nextcloud and monitor for unusual approval submissions.

Long-Term Recommendations:

• Adopt a least-privilege model for workflow roles. Ensure that only users who need to submit files for approval have the requester role.
• Regularly review and audit workflow configurations and approval records.
• Implement file access checks in all custom apps that handle file IDs.

Valters IT