NextChat Directory Traversal Vulnerability in WebDAV Proxy

A directory traversal vulnerability has been identified in NextChat versions through 2.16.0. This issue arises from the WebDAV proxy's failure to properly canonicalize or reject dot path segments in its catch-all route. As a result, attackers can exploit this vulnerability to access sensitive information through authenticated or anonymous WebDAV endpoints.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive information via the WebDAV interface.

Reproduction

The vulnerability can be reproduced by sending a WebDAV request that includes dot path segments, such as '../', to the WebDAV proxy endpoint. This can be done either authenticated or anonymously, depending on the WebDAV endpoint's configuration. The proxy will not properly handle the traversal, potentially leading to exposure of sensitive files or data.