# Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file

Nextcloud's default encryption module builds block MAC keys by ambiguous concatenation of version and position, letting a storage-level attacker swap blocks between file versions without keys.

- Payout: hidden
- Severity: low
- Program: Nextcloud
- Found by: weizenspreu
- Disclosed: 2020-11-05
- CVE: CVE-2020-8133
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/661051
- Library page: https://bugbountylibrary.com/r/h1%3A661051
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:crypto

**Target:** Nextcloud server default encryption module (apps/encryption Crypt.php) block MAC
**Root cause:** MAC key salt is hash('sha512', $passPhrase.$version.$position."a") with no delimiter, so version/position pairs like (1,10) and (11,0) collide; same file key and envelope keys are reused across versions.
**Steps:**
1. Create file: `php -r 'print(str_repeat("A", 6072*10).str_repeat("B", 6072)."1");' > ./collision.txt`
2. Upload to Nextcloud, back up encrypted v1: `cp ./collision.txt ./collision.txt.1`
3. Edit file to create 11 versions; verify via `select encrypted from oc_filecache where path = 'files/collision.txt';`
4. Overwrite block position 0 with block position 11 from v1: `dd if=./collision.txt.1 of=./collision.txt bs=8192 conv=notrunc skip=11 seek=1 count=1`
5. Download again; first block changed but signature check passes
**How found:** Code reading of Crypt.php MAC construction: noticed version and position are concatenated without a separator, hypothesized cross-version block substitution, then built a collision file with 11 versions to confirm.
**Exploitation:** Attacker with persistent storage access (admin or external storage provider) copies a 6072-byte block from an earlier version of the same file into the current version's block slot whose (version,position) concatenation collides, without any encryption keys.
**Insight:** When MAC/AEAD associated data concatenates multiple variable-length fields, check for missing delimiters/length prefixes that let (a,bc) collide with (ab,c); also check whether keys are reused across versions so blocks can be transplanted.