CVE-2021-43863: nextcloud android SQL Injection

Vulnerability summary

CVE-2021-43863 is a high (CVSS 7.5) SQL Injection vulnerability in nextcloud android. EPSS estimates a 1.87% chance of exploitation in the next 30 days, higher than 79% of scored vulnerabilities.

Timeline

1. 25-01-2022
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading.

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.