Fix for crowdsecurity#1102

brknkfr · Aug 27, 2024 · 39e31a0 · 39e31a0
1 parent d1c197d
commit 39e31a0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/parsers/s02-enrich/crowdsecurity/nextcloud-whitelist.md b/parsers/s02-enrich/crowdsecurity/nextcloud-whitelist.md
@@ -23,6 +23,8 @@ When previews are missing for files in the trash bin, a 404 error is returned wh
 
 In rare cases HTTP Probing will be triggered when opening multiple folders quickly, Nextcloud checks for a ``readme.md`` file and if it doesn't exist a 404 error is thrown.
 
+Auto uploading files from mobile clients authenticated with app token returns 403 on '/remote.php/dav/files/FILENAME' when checking for existing files.
+
 ---
 ### Creating files via WebDAV
 When uploading files via WebDAV, a PROPFIND request is sent to the server, which returns 404 if the file does not

diff --git a/parsers/s02-enrich/crowdsecurity/nextcloud-whitelist.yaml b/parsers/s02-enrich/crowdsecurity/nextcloud-whitelist.yaml
@@ -16,3 +16,4 @@ whitelist:
    - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path matches '\\/apps\\/files\\/api\\/v1\\/thumbnail\\/(\\d+)/(\\d+)'
    - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/bookmarks/bookmark' && (evt.Meta.http_path endsWith 'favicon' || evt.Meta.http_path endsWith 'image') #When loading NC bookmarks: some entries might have no favicon or no image
    - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/bookmarks/folder' && evt.Meta.http_path endsWith 'publictoken' #When loading NC bookmarks: private folders have no publictoken
+   - evt.Meta.http_status == '403' && evt.Meta.http_verb == 'HEAD' && evt.Meta.http_path contains '/remote.php/dav/files' #Auto uploading files from mobile nextcloud clients authenticated with app token