# Combination of content provider allows private data disclosure

Exported DiskLruImageCacheFileProvider combined with the file content provider lets any Android app enumerate filenames and read private file thumbnails from Nextcloud storage.

- Payout: $100
- Severity: low
- Program: Nextcloud
- Credited: doragon
- Disclosed: 2019-07-26
- CVE: CVE-2019-5452
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/534541
- Library page: https://bugbountylibrary.com/r/h1%3A534541
- Tags: domain:mobile impact:data-leak kind:bounty platform:hackerone sev:low tech:android technique:chained technique:recon vuln:access-control vuln:info-disclosure

**Target:** Nextcloud Android app content providers (org.nextcloud/file and org.nextcloud.imageCache.provider)
**Root cause:** DiskLruImageCacheFileProvider is exported and accepts arbitrary filenames, while the file content provider leaks the storage file structure including filenames, enabling cross-app thumbnail extraction.
**Steps:**
1. `adb shell content query --uri content://org.nextcloud/file` to enumerate filenames/paths of synced files
2. Take a filename from output, e.g. `1553357105332.jpg`
3. `adb shell content read --uri content://org.nextcloud.imageCache.provider/1553357105332.jpg` to read the generated thumbnail of that private file
**How found:** Researcher, a daily Nextcloud user, recalled prior reports (#489105 thumbnail disclosure, #518669 file status exposure) and hypothesized that chaining the two content providers bypasses the intended thumbnail protection.
**Exploitation:** Any installed malicious app queries the exported file content provider to harvest filenames, then requests each via the exported imageCache provider to obtain thumbnails of private pictures/text files without permissions.
**Insight:** On Android, enumerate every exported content provider via `adb shell content query`; a metadata provider leaking filenames can weaponize a separate filename-keyed cache provider that lacks its own access control.