Self-Hosted Cloud Security

Nextcloud Security Testing: Default Credentials, WebDAV Exposure, Path Traversal, and File Sharing Misconfiguration

📅 July 3, 2026 ⏱ 14 min read 🏷 Nextcloud, Self-Hosted Cloud Storage, WebDAV Security, File Sharing Security, Cloud Security

Nextcloud Discovery and Version Fingerprinting

# Nextcloud version exposed without authentication at /status.php
curl -s "https://nextcloud.example.com/status.php" 2>/dev/null | \
  python3 -c "
import json,sys
d = json.load(sys.stdin)
print(f\"Nextcloud version: {d.get('version','?')}\")
print(f\"Version string: {d.get('versionstring','?')}\")
print(f\"Maintenance: {d.get('maintenance','?')}\")
print(f\"Edition: {d.get('edition','?')}\")
" 2>/dev/null

# Also check /ocs/v1.php/cloud/capabilities (version + capabilities without full auth)
curl -s "https://nextcloud.example.com/ocs/v1.php/cloud/capabilities?format=json" \
  -H "OCS-APIRequest: true" 2>/dev/null | \
  python3 -c "
import json,sys
d = json.load(sys.stdin)
caps = d.get('ocs',{}).get('data',{}).get('version',{})
print(f\"Version: {caps.get('string','?')} (major={caps.get('major','?')})\")
" 2>/dev/null

WebDAV File Enumeration and Download

# Nextcloud WebDAV endpoint — accessible to all authenticated users
# PROPFIND lists directory contents; GET downloads files

# Test authentication with credentials
USERNAME="admin"
PASSWORD="admin"  # or weak password
NEXTCLOUD_URL="https://nextcloud.example.com"

# List all files in root directory via WebDAV PROPFIND
curl -s -X PROPFIND \
  "${NEXTCLOUD_URL}/remote.php/dav/files/${USERNAME}/" \
  -u "${USERNAME}:${PASSWORD}" \
  -H "Depth: 1" \
  -H "Content-Type: application/xml" \
  -d '' \
  2>/dev/null | python3 -c "
import sys,re
content = sys.stdin.read()
# Extract file paths and sizes from WebDAV response
files = re.findall(r'([^<]+)', content)
sizes = re.findall(r'(\d+)', content)
print(f'Files found: {len(files)}')
for f, s in zip(files[:10], sizes[:10] + ['?']*(10-len(sizes))):
    print(f'  {f} ({s} bytes)')
" 2>/dev/null

# Check OCS API — list all users (admin only)
curl -s "${NEXTCLOUD_URL}/ocs/v1.php/cloud/users?format=json" \
  -u "${USERNAME}:${PASSWORD}" \
  -H "OCS-APIRequest: true" 2>/dev/null | \
  python3 -c "
import json,sys
d = json.load(sys.stdin)
users = d.get('ocs',{}).get('data',{}).get('users',[])
print(f'Users: {users[:20]}')
" 2>/dev/null

Nextcloud Security Hardening

Security Test	Method	Risk
Version disclosure via /status.php without authentication	GET /status.php — returns version string enabling targeted CVE exploitation of known Nextcloud vulnerabilities	Medium
Default admin/admin credentials	POST /index.php/login with admin/admin — common in self-hosted deployments that skipped setup hardening	Critical
WebDAV file enumeration and bulk download	PROPFIND /remote.php/dav/files/{user}/ — lists entire file tree; GET downloads any file; all with just credentials	High
Admin API user enumeration	GET /ocs/v1.php/cloud/users with admin credentials — lists all Nextcloud usernames and account details	High
Public share tokens granting unauthenticated file access	GET /s/{token} — any disclosed share token provides access without login; assess token disclosure in emails/links	High
External storage pointing to sensitive server paths	Review external storage configuration — local filesystem mounts can expose OS files outside Nextcloud data directory	High