↓Skip to main content
  1. Posts/

Messages can still be seen on conversation after expiring when cron is misconfigured

·1 min
Nextcloud bugbounty CVE-2023-26041
Nextcloud talk has a feature called Message Expiration, Chat messages can be expired after a certain time. In order for messages to be removed from the database, the cron jobs need to be executed. However what would be the failover if in some cases the cron did not execute?

Proof of Concept: #

  1. Create a conversation
  2. Set the message expiration Go to Settings > Moderation
  3. Pick anything and using burp intercept the request and set it to 60 or 120 seconds.
  4. send a message
  5. wait for the message to expire
  6. Copy the conversation link and open it to a new tab

References #