CVE-2024-37885: Code Injection in Nextcloud Desktop Client

The vulnerability lies in how the Nextcloud Desktop Client handles the DYLDINSERTLIBRARIES environment variable on macOS. If an attacker can control this environment variable, they can inject malicious code that will be executed when the client starts. This could lead to arbitrary code execution with the privileges of the Nextcloud Desktop Client process, potentially allowing an attacker to gain access to synchronized files, modify data, or compromise the user's system. The impact is limited by the client's permissions, but successful exploitation could still be significant.

1. Reserved2024-06-10
2. Published2024-06-14
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-37885 is to upgrade the Nextcloud Desktop Client to version 3.12.0 or later. If upgrading is not immediately possible, restrict access to the DYLDINSERTLIBRARIES environment variable. This can be achieved by carefully controlling the environment in which the client is launched and ensuring that only trusted processes can modify it. Consider implementing stricter security policies around environment variable manipulation. After upgrade, confirm by launching the client and verifying that the DYLDINSERTLIBRARIES variable is not being exploited.