Mail: App seems to not verify TLS certificates

[AuspeXeu]

I just set up my email account using imap.mydomain.com and smtp.mydomain.com. However, I am serving a self-signed certificate to do the TLS encryption. The app did not complain at all even though I did not import any sort of certificate authority. In a next test, I presented it with a certificate for imap.anotherdomain.com and smtp.anotherdomain.com again, not error or anything. This seems like a huge security risk to me. Could you please clarify if/how the certificate verification is happening. From my understanding, the current behavior allows MitM attacks using an arbitrary certificate which ultimately allows the attacker to obtain the user's credentials and hence full access to their email accounts.

Edit: It seems like this issue is known since 2017 (#308). Without resolving this, the app seems like a massive security risk to any organization using the mail app inside their nextcloud installation.

[ChristophWurst]

I'll have a look. Next time please use https://hackerone.com/nextcloud for such issues.

[ChristophWurst]

Closing as dup of #308. Let's continue there.

[AuspeXeu]

I actually was on this hackerone.com website but honestly didn't find the correct category to report it in. Could you point me to it?

[ChristophWurst]

You start at https://hackerone.com/nextcloud/reports/new. If you need any help you can also first ask for it on help.nextcloud.com. The important part is not to disclose a possible security issue before it's taken care of.

[AuspeXeu]

Well, given this was first disclosed to you in 2017 I feel like you kinda had a lot of time to look into this, didn't you?

[fti7]

Yes, 3 Years should be enough for the risk assessment 😄
But indeed i didnt reported it via hackerone in 2017. Sorry for that 😞😄