Summary
The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOK_SECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The user_id is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.
Details
Vulnerable file: nextcloud_mcp_server/vector/webhook_receiver.py, function handle_nextcloud_webhook(), lines 55-67
Root cause 1: Auth check is guarded by if secret: - skipped entirely when WEBHOOK_SECRET is unset.
Root cause 2: webhook_secret: str | None = None in config - no startup validator enforces it, even when vector sync is enabled.
Trusted field: payload["user"]["uid"] in webhook_parser.py is used as-is for all Qdrant operations - no cross-check against an authenticated session.
webhook_receiver.py, lines 55-67:
secret = get_settings().webhook_secret # None by default
if secret: # skipped entirely when unset
... validate Bearer header ...
else:
_warn_missing_secret_once() # just logs, still processeswebhook_parser.py, line 57:
user_id = payload["user"]["uid"] # attacker-controlled
PoC
No credentials required. Works on any deployment where WEBHOOK_SECRET is not explicitly set (the default).
POST /webhooks/nextcloud
Content-Type: application/json
{
"event": {
"class": "OCP\\Files\\Events\\Node\\BeforeNodeDeletedEvent",
"node": { "path": "/victim/files/Notes/any.md", "id": 12345 }
},
"user": { "uid": "victim" },
"time": 0
}Result: Qdrant deletes all vector embeddings for victim doc 12345 with no authentication. Attacker can loop over doc IDs for mass deletion. All user targets accepted.
Impact
- Anyone on the network with access to port
8000 - no credentials needed.
- Attacker can delete or trigger re-index of any user's vector embeddings in Qdrant by spoofing
user.uid in the payload.
- Mass-sending delete events for all doc IDs destroys the entire semantic search index for all users, requiring a full re-scan to recover.
Recommend Fix
- Enforce
WEBHOOK_SECRET at startup ( file config_validators.py )
if vector_sync_enabled and not settings.webhook_secret:
raise ConfigurationError(
"WEBHOOK_SECRET must be set when vector sync is enabled"
)
- Reject requests when secret is unset ( file
webhook_receiver.py )
secret = get_settings().webhook_secret
if not secret:
return JSONResponse({"status": "unavailable"}, status_code=503)
provided = request.headers.get("authorization", "").encode()
if not hmac.compare_digest(provided, f"Bearer {secret}".encode()):
return JSONResponse({"status": "unauthorized"}, status_code=401)References
fortress07 Reporter
Summary
The
POST /webhooks/nextcloudendpoint has no authentication by default:WEBHOOK_SECRETdefaults toNoneand is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. Theuser_idis taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.Details
Vulnerable file:
nextcloud_mcp_server/vector/webhook_receiver.py, functionhandle_nextcloud_webhook(), lines 55-67Root cause 1: Auth check is guarded by
if secret: - skipped entirely whenWEBHOOK_SECRETis unset.Root cause 2:
webhook_secret: str | None = Nonein config - no startup validator enforces it, even when vector sync is enabled.Trusted field:
payload["user"]["uid"]inwebhook_parser.pyis used as-is for all Qdrant operations - no cross-check against an authenticated session.webhook_receiver.py, lines 55-67:webhook_parser.py, line 57:PoC
No credentials required. Works on any deployment where
WEBHOOK_SECRETis not explicitly set (the default).Result: Qdrant deletes all vector embeddings for
victimdoc12345with no authentication. Attacker can loop over doc IDs for mass deletion. All user targets accepted.Impact
8000- no credentials needed.user.uidin the payload.Recommend Fix
WEBHOOK_SECRETat startup ( fileconfig_validators.py)webhook_receiver.py)References