CVE-2025-66558

Executive Summary

CVE-2025-66558 is a Missing Authorization vulnerability in the Nextcloud Twofactor WebAuthn app, which provides WebAuthn-based two-factor authentication (2FA) for Nextcloud instances. The flaw allows an authenticated attacker, who can guess a long (80-128 character) random string (the device ID), to delete a victim's registered WebAuthn 2FA device. This forces the victim to re-register a new device on their next login, effectively removing their 2FA protection temporarily. The attacker cannot authenticate as the victim, but the attack degrades the security posture of the targeted user.

The vulnerability has a low CVSS score of 3.1 due to the high complexity of guessing the device ID and the limited impact (no authentication bypass). However, in a targeted attack where the device ID is leaked or brute-forced, this could be used to harass users or weaken their account security.

Supply Chain & Package Security

This vulnerability affects the Nextcloud Twofactor WebAuthn app, which is distributed via the Nextcloud App Store and is a PHP-based component of the Nextcloud ecosystem. It is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is low, as the app is maintained by Nextcloud and updates are pushed through the official app store. However, administrators must ensure they update the app to the patched versions (1.4.2 or 2.4.1) to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attack is performed over the network.
• Attack Complexity (AC): High – The attacker must guess a random 80-128 character string.
• Privileges Required (PR): Low – The attacker needs a valid Nextcloud account.
• User Interaction (UI): None – No victim interaction is required.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – The victim's 2FA device is removed, but no data is modified.
• Availability (A): None – The service remains available.

Threat Level: Low. The attack is difficult to execute due to the high complexity of guessing the device ID. However, if the device ID is leaked (e.g., via logs or other vulnerabilities), the attack becomes trivial.

Deep Dive & Mechanics

The Nextcloud Twofactor WebAuthn app allows users to register hardware security keys (e.g., YubiKeys) as a second factor for authentication. Each registered device is stored in the database with a unique, randomly generated device ID (80-128 characters long, consisting of letters, numbers, and symbols).

The vulnerability lies in the device deletion endpoint. When a user requests to delete a WebAuthn device, the application does not verify that the requesting user is the owner of the device. Instead, it only checks if the device ID exists in the database. An attacker can craft a request to delete any device by providing its ID.

Attack Flow:

1. The attacker authenticates to Nextcloud with their own account.
2. The attacker obtains the victim's device ID (e.g., through guessing, brute-forcing, or information disclosure).
3. The attacker sends a DELETE request to the endpoint /apps/twofactor_webauthn/webauthn/{deviceId} with the victim's device ID.
4. The server deletes the device without verifying ownership.
5. On the victim's next login, they are prompted to register a new WebAuthn device, as their existing one is gone.

Why it's not a full account takeover: The attacker cannot authenticate as the victim because they do not have the victim's password or the physical security key. The attack only removes the 2FA device, forcing the victim to re-enroll.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.4.2 / pre-2.4.1):

// In Controller/WebAuthnController.php
public function delete($deviceId) {
    $device = $this->deviceMapper->findByDeviceId($deviceId);
    if ($device) {
        $this->deviceMapper->delete($device);
        return new JSONResponse(['success' => true]);
    }
    return new JSONResponse(['error' => 'Device not found'], 404);
}

The code does not check if $device->getUserId() matches the current user's ID.

Patched Code (1.4.2 / 2.4.1):

// In Controller/WebAuthnController.php
public function delete($deviceId) {
    $device = $this->deviceMapper->findByDeviceId($deviceId);
    if ($device && $device->getUserId() === $this->userId) {
        $this->deviceMapper->delete($device);
        return new JSONResponse(['success' => true]);
    }
    return new JSONResponse(['error' => 'Device not found or not owned'], 404);
}

The patch adds an ownership check: $device->getUserId() === $this->userId. If the device does not belong to the requesting user, the deletion is denied.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid Nextcloud account on the target instance.
• Knowledge of the victim's WebAuthn device ID (80-128 character random string).

Exploitation Steps:

1. Obtain the victim's device ID. This could be done by:
   • Brute-forcing (not practical due to length).
   • Exploiting another vulnerability that leaks device IDs (e.g., SQL injection, information disclosure).
   • Social engineering to trick the victim into revealing their device ID.
2. Send a DELETE request to the vulnerable endpoint:

   curl -X DELETE \
     -H "OCS-APIRequest: true" \
     -H "Authorization: Bearer <attacker_token>" \
     "https://nextcloud.example.com/apps/twofactor_webauthn/webauthn/<victim_device_id>"
   

3. The victim's device is removed. On their next login, they will be prompted to register a new device.

Note: No public exploit code is available for this CVE.

Blue Team (Detection & Prevention)

Detection:

• Monitor logs for DELETE requests to /apps/twofactor_webauthn/webauthn/ from users who are not the device owner.
• Alert on multiple failed deletion attempts (e.g., 404 errors) from the same user, indicating brute-forcing.

Prevention:

• Immediately update the Twofactor WebAuthn app to version 1.4.2 or 2.4.1.
• Implement additional logging for all 2FA device management actions.
• Use Web Application Firewall (WAF) rules to block suspicious DELETE requests.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP DELETE requests to /apps/twofactor_webauthn/webauthn/{deviceId} from non-owner users.
  • Repeated 404 responses from the same endpoint, indicating brute-force attempts.

• Log IOCs:

  • Nextcloud audit log entries showing WebAuthn device deleted for a user who did not initiate the action.
  • PHP error logs showing Device not found errors from the WebAuthn controller.

• File IOCs:

  • Modified or deleted entries in the twofactor_webauthn_devices database table.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_66558_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66558 in Nextcloud logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-66558"
    strings:
        $delete_request = "DELETE /apps/twofactor_webauthn/webauthn/"
        $device_id_pattern = /[a-zA-Z0-9!@#$%^&*()_+\-=\[\]{}|;':\",.\/<>?`~]{80,128}/
        $error_404 = "Device not found"
    condition:
        $delete_request and $device_id_pattern and $error_404
}

Sigma Rule

title: Nextcloud WebAuthn Device Deletion Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to delete a WebAuthn device in Nextcloud, which may indicate exploitation of CVE-2025-66558.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nextcloud
detection:
    selection:
        http.method: 'DELETE'
        http.url|contains: '/apps/twofactor_webauthn/webauthn/'
    condition: selection
falsepositives:
    - Legitimate device deletion by the owner
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66558 Nextcloud WebAuthn Device Deletion Attempt"; flow:to_server; http.method; content:"DELETE"; http.uri; content:"/apps/twofactor_webauthn/webauthn/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Twofactor WebAuthn app to version 1.4.2 (for 1.x branch) or 2.4.1 (for 2.x branch) via the Nextcloud App Store.
2. Verify the update by checking the app version in the Nextcloud admin panel.

Long-term Mitigations:

• Implement rate limiting on the device deletion endpoint to prevent brute-forcing.
• Enable audit logging for all 2FA-related actions and monitor for anomalies.
• Educate users to report unexpected 2FA re-registration prompts.

Workaround (if patching is not immediately possible):

• Disable the Twofactor WebAuthn app temporarily and use an alternative 2FA method (e.g., TOTP).
• Restrict API access to the deletion endpoint via a Web Application Firewall (WAF) or reverse proxy.

Valters IT
Securing Digital Frontiers