CVE-2025-66553

Executive Summary

CVE-2025-66553 is an authorization bypass vulnerability in Nextcloud Tables, a collaborative table management application. The flaw allows authenticated users to view metadata of columns in tables they do not own or have explicit access to. By manipulating a numeric ID in a request, an attacker can enumerate column metadata across the instance, leading to information disclosure. The vulnerability has a CVSS score of 4.3 (Medium) and is patched in versions 0.8.7 and 0.9.4. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

Nextcloud Tables is distributed as a Nextcloud app. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application logic itself. Administrators should ensure they update the app through the Nextcloud App Store or manual installation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker must have a valid Nextcloud account.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Only column metadata is exposed, not the actual data.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires authentication but allows unauthorized access to metadata across tables, potentially aiding reconnaissance for further attacks.

Deep Dive & Mechanics

The Nextcloud Tables app uses numeric IDs to identify tables and columns. When a user requests column metadata (e.g., column names, types, order), the application fails to verify that the user has permission to access the table associated with the column ID. An attacker can enumerate column IDs by incrementing or guessing numeric values in API requests.

The vulnerable endpoint likely resembles:

GET /apps/tables/api/columns/{columnId}

The server returns metadata without checking if the user is a member of the table's share or owner. This is a classic Insecure Direct Object Reference (IDOR) vulnerability (CWE-639).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-0.8.7 / 0.9.4):

// No permission check on column retrieval
public function getColumn(int $columnId): DataResponse {
    $column = $this->columnMapper->find($columnId);
    if ($column === null) {
        return new DataResponse([], Http::STATUS_NOT_FOUND);
    }
    return new DataResponse($column->jsonSerialize());
}

Patched Code (0.8.7 / 0.9.4):

// Permission check added
public function getColumn(int $columnId): DataResponse {
    $column = $this->columnMapper->find($columnId);
    if ($column === null) {
        return new DataResponse([], Http::STATUS_NOT_FOUND);
    }
    $table = $this->tableMapper->find($column->getTableId());
    if (!$this->permissionService->userHasAccessToTable($table, $this->userId)) {
        return new DataResponse([], Http::STATUS_FORBIDDEN);
    }
    return new DataResponse($column->jsonSerialize());
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a Nextcloud instance with Tables app version 0.8.6 or 0.9.3. Create two users: attacker and victim. As victim, create a table with columns (e.g., "Name", "Email"). Do not share the table with attacker.
2. Exploitation:
   • Authenticate as attacker and obtain a session token.
   • Enumerate column IDs starting from 1:

     GET /apps/tables/api/columns/1
     GET /apps/tables/api/columns/2
     

   • The response will include metadata for columns the attacker should not have access to.
3. Automation: Use a script to iterate through column IDs and collect metadata.

Blue Team

1. Detection: Monitor for repeated requests to /apps/tables/api/columns/ with sequential or out-of-range IDs from a single user.
2. Logging: Enable Nextcloud audit logs to capture API access.
3. Mitigation: Apply the patch immediately. If patching is delayed, restrict access to the Tables app using Nextcloud's app management or firewall rules.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /apps/tables/api/columns/{id} where {id} is a numeric value not associated with the user's tables.
• Logs: Audit log entries showing GET /apps/tables/api/columns/ with 200 status codes for tables the user does not own.
• User Behavior: A user accessing column metadata for multiple tables in a short time frame.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_66553_Exploitation {
    meta:
        description = "Detects exploitation attempts for CVE-2025-66553 via API requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66553"
    strings:
        $api_path = "/apps/tables/api/columns/"
        $numeric_id = /\/apps\/tables\/api\/columns\/\d+/
    condition:
        $api_path and #numeric_id > 5
}

Sigma Rule

title: Nextcloud Tables Column Metadata Enumeration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects enumeration of column metadata in Nextcloud Tables
author: Valters IT
logsource:
    category: webserver
    product: nextcloud
detection:
    selection:
        cs-uri-query|contains: "/apps/tables/api/columns/"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate access to own tables
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66553 Nextcloud Tables Column Metadata Enumeration";
    flow:to_server,established;
    content:"/apps/tables/api/columns/";
    http_uri;
    pcre:"/\/apps\/tables\/api\/columns\/\d+/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Update Nextcloud Tables to version 0.8.7 or 0.9.4 via the Nextcloud App Store.
2. Workaround: If patching is not possible, restrict access to the Tables app using Nextcloud's app management or a reverse proxy rule blocking /apps/tables/api/columns/ for non-admin users.
3. Long-term: Implement proper authorization checks for all API endpoints. Conduct regular security audits of custom apps.

Valters IT
Securing Digital Frontiers