Impact

Successful exploitation of CVE-2024-28112 allows an attacker to achieve full remote code execution on the server hosting Nextcloud. This provides the actor with unauthorized access to file stores, user credentials, and database contents, potentially leading to total system compromise and data exfiltration.

Recommendation

• Identify all internet-facing Nextcloud Hub instances and audit logs for anomalous POST requests or unexpected child processes spawned by the web server user.
• Apply the security update provided by Nextcloud to resolve CVE-2024-28112 immediately.
• Review web server access logs for requests containing suspicious payload patterns that could indicate attempted exploitation of the input handling flaw.