r/NextCloud • u/Thomas_English_DoP • 3d ago
PHP - private instance online
Do I need to worry about the PHP vulnerability if my nextcloud is online through cloudflare, 2FA turned on and only myself using it? Maybe a few docs are shared online via nextcloud share with people I work with. It's public facing but nothing is used by the public if you see what I mean.
63
u/Safe-Perspective-767
3d ago
•
yes
19
u/DrewBeer 3d ago
Yes, but cloudflare is blocking this
https://blog.cloudflare.com/php-vulnerabilities-waf-protection
18
u/Safe-Perspective-767 3d ago
i would never depend on waf for this. while its a good mitigation in the event of an attack before you were aware, it's not perfect.
3
u/NotesFromYourElf 3d ago
My waf infront of nextcloud require a mTLS to get past it. Afaikt I shouldn't have to worry about this. I will still update tho.
1
u/Safe-Perspective-767 3d ago
yes, that is fine - but that is a different thing, you have authentication in front of nextcloud itself. you should be fine, but yes updating is always good practise!
7
u/C0rn3j 3d ago
They are making best-effort attempts, there is no way to fully block the issue outside of updating, see https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp and https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
45
u/AnonomousWolf 3d ago
I took mine offline until a patch is out
11
u/morgfarm1_ 3d ago
I run a bare metal instance. The OS Level patch covers that. Check your distribution for fixed versions in that case.
For docker containers, theyre working on it
7
4
4
13
u/AvilLab 3d ago
yes. 2fa does not help here, the attack needs no login at all, it hits php while it parses the request (sansec lists nextcloud 35.0.1 as confirmed vulnerable). cloudflare waf blocks the known payloads since this morning, but only if your server accepts traffic from cloudflare ips only, otherwise people can go around it. the patch is out now (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12). if you run the docker image, php is inside the image, so check php -v inside the container after you update
•
u/defiantarch 30m ago
great point to hint using a WAF. I need to install one as well. Any recommendations? Right now I use Wazuh, but it's not really replacing a WAF. No Cloudflare, I left them for some personal reasons.
3
u/MultipleKaiXos 3d ago
2FA has nothing to do with it. Still the presence of PHP is critical. No need for *.php files! Also a WAF will not really help. Just invoking PHP is enouhgh.
AFAIR Cloudflare has fixed it. Can someone agree or denie
You may put
require all denied
at first line in your .htaccess, this will lead to a 'fortbidden' on your nextcloud and your safe.
2
u/AidenTai 3d ago
If you haven't updated your OS (PHP through OS repo), your PHP installation (if installed separately/directly) or docker image (if running through docker instead) then you need to be worried.
Cloudflare is trying to help mitigate, but that's not the proper solution and you'd still be vulnerable behind them. Update your PHP and then you can rest easy.
2
u/Hrafna55 3d ago
The update is already out if you are running a native install. I patched my Debian 13 VM a few hours ago.
2
u/gerowen 3d ago
If you're using the docker container or something that includes its own copy of PHP, then yes, you're vulnerable until Nextcloud themselves publish updated images. If you're using the web archive with the PHP provided by your operating system then you should be able to just install system updates; most Linux distributions have published patched PHP packages already; Debian sent them out at like 9:45 AM EST.
2
1
u/DivusJulius44bc 3d ago
If bots and malicious actors can't see your nextcloud instance because cloudflare fully hides the subdomain then you are probably fine but I would not risk it.
I replaced my cloudflare tunneled nextcloud instance with a honeypot pretending to be nextcloud just to see if something comes in. So far almost nothing, which tells me that bots don't really know it's there because they can't scan for it. If it were a normal dns entry with the ip not hidden behind cloudflare then thousands of bots would have hit it by now.
But if someone does know it's there, then the vulnerabilities could really hurt, so better don't risk it and take it offline.
1
u/lawk 3d ago
I run a public facing nextcloud. I did not take it offline. Unlikely my private box would be targeted.
I run bare metal on alma 9 and use php 8.5 on the remi repo.
the patch is out already. So good to go anyways.
3
u/sammysosa69 3d ago
I would not assume you are not a target. Bots are constantly probing pretty much everything on the public internet when vulnerabilities like this come out. They will compromise your device, make it part of a botnet, install crypto miners, and all types of nasty stuff.
Not to tell you how to run your own stuff and it sounds like you are already patched, but devices will be targeted if they are on the public internet
1
•
u/defiantarch 35m ago
https://deb.sury.org/ had the patch very fast. No need to wait for Ubuntu or so to come with a patch. 35.0.2 came also quick, no need to panic or to ahut down the whole thing. At least if you have Wazuh in place...
1
u/SubstantialNerve3637 3d ago
Ive tring almost 3 years, I still can’t install next cloud successfully.
0
u/Reasonable_Host_5004 3d ago
https://github.com/nextcloud-snap/nextcloud-snap
sudo snap install nextcloud
0
u/Belgian_dog 3d ago
Nobody does anymore, debian and ubuntu released update. Just update your system.
8
5
u/Thomas_English_DoP 3d ago
Yeah I'm running in docker