nextcloud / nextcloud/spreed

Action "talkRoomToken" triggers bruteforce protection

Open
#15,028 8 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Needs triage
Dominant language
JavaScript
Stars
2.2k
Forks
586
Avg merge
18h 27m
Merged PRs (30d)
333

Description

How to use GitHub
  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Steps to reproduce

  1. Unclear
Expected behaviour

Valid talk requests to the nextcloud server don't trigger bruteforce protection.

Actual behaviour

I'm seeing hundreds of requests to the nextcloud server with the action "talkRoomToken" that trigger the bruteforce protection for no apparent reason. The requests come from various different users, clients (browser, Android app, etc.) and ip addresses. The IP based bruteforce protection causes issues für some other clients and machines that use the WebDAV endpoint and as a result fail to authenticate (because bruteforce protection limits attempts).

I also issued this here with more details:
https://github.com/nextcloud/server/issues/52480

In my case this is a very serious issue that has a very high impact on operations.

Talk app

Talk app version: 21.0.4

Custom Signaling server configured: no

Custom TURN server configured: no

Custom STUN server configured: no

Browser

Microphone available: irrelevant

Camera available: irrelevant

Operating system: various

Browser name: various

Browser version: various

Server configuration

Operating system: Ubuntu

Web server: Apache

Database: MySQL

PHP version: 8.2

Nextcloud Version: 31.0.4.1

List of activated apps:

Enabled:
  - activity: 4.0.0
  - announcementcenter: 7.1.0
  - app_api: 5.0.2
  - approval: 2.2.0
  - bookmarks: 15.1.0
  - bruteforcesettings: 4.0.0
  - calendar: 5.2.2
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.0.6
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0
  - dav: 1.33.0
  - deck: 1.15.0
  - federatedfilesharing: 1.21.0
  - files: 2.3.1
  - files_accesscontrol: 2.0.0
  - files_antivirus: 6.0.0
  - files_automatedtagging: 2.0.0
  - files_downloadlimit: 4.0.0
  - files_external: 1.23.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_retention: 2.0.1
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - flow_notifications: 2.0.0
  - fulltextsearch_elasticsearch: 31.0.0
  - groupfolders: 19.0.4
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - nextcloud_announcements: 3.0.0
  - notes: 4.12.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - oidc_login: 3.2.2
  - password_policy: 3.0.0
  - passwords: 2025.4.10
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - related_resources: 2.0.0
  - richdocuments: 8.6.4
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - spreed: 21.0.3
  - support: 3.0.0
  - systemtags: 1.21.1
  - text: 5.0.0
  - theming: 2.6.1
  - theming_customcss: 1.18.0
  - twofactor_admin: 4.8.0
  - twofactor_backupcodes: 1.20.0
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - twofactor_webauthn: 2.1.0
  - updatenotification: 1.21.0
  - user_saml: 6.5.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflow_pdf_converter: 2.0.0
  - workflow_script: 2.0.0
  - workflowengine: 2.13.0
Disabled:
  - admin_audit: 1.21.0
  - circles: 31.0.0 (installed 27.0.1)
  - encryption: 2.19.0
  - federation: 1.21.0 (installed 1.17.0)
  - firstrunwizard: 4.0.0 (installed 2.12.0)
  - fulltextsearch: 31.0.0 (installed 31.0.0)
  - mail: 4.3.6 (installed 4.3.6)
  - photos: 4.0.0-dev.1 (installed 2.0.1)
  - polls: 7.4.2 (installed 7.4.2)
  - recommendations: 4.0.0 (installed 1.6.0)
  - serverinfo: 3.0.0 (installed 1.17.0)
  - survey_client: 3.0.0 (installed 1.15.0)
  - suspicious_login: 9.0.1
  - user_ldap: 1.22.0
  - webhooks: 0.4.3 (installed 0.4.3)
  - welcome: 1.2.1 (installed 1.2.1)

Nextcloud configuration:

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***",
            "***",
            "***",
            "***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "31.0.4.1",
        "overwrite.cli.url": "***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0
        },
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "***",
            "***"
        ],
        "twofactor_enforced_excluded_groups": [
            "***",
            "***",
            "***",
            "***"
        ],
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtpsecure": "tls",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "maintenance": false,
        "default_language": "de",
        "default_locale": "de_DE",
        "theme": "",
        "loglevel": 1,
        "default_phone_region": "DE",
        "app_install_overwrite": {
            "1": "flow_notifications",
            "2": "twofactor_admin",
            "3": "webhooks"
        },
        "defaultapp": "dashboard",
        "session_lifetime": 86400,
        "remember_login_cookie_lifetime": 1296000,
        "auto_logout": false,
        "session_keepalive": true,
        "enable_previews": true,
        "enabledPreviewProviders": [
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\PDF",
            "OC\\Preview\\MSOffice2003",
            "OC\\Preview\\MSOfficeDoc",
            "OC\\Preview\\PDF",
            "OC\\Preview\\Image",
            "OC\\Preview\\Photoshop",
            "OC\\Preview\\TIFF",
            "OC\\Preview\\SVG",
            "OC\\Preview\\Font",
            "OC\\Preview\\MP3",
            "OC\\Preview\\Movie",
            "OC\\Preview\\MKV",
            "OC\\Preview\\MP4",
            "OC\\Preview\\AVI"
        ],
        "preview_max_memory": 1024,
        "preview_max_x": 1024,
        "preview_max_y": 1024,
        "preview_max_filesize_image": 200,
        "trashbin_retention_obligation": "30,60",
        "onlyoffice": {
            "verify_peer_off": true,
            "jwt_header": "AuthorizationJwt"
        },
        "preview_libreoffice_path": "\/usr\/bin\/libreoffice",
        "htaccess.RewriteBase": "\/",
        "allow_user_to_change_display_name": false,
        "lost_password_link": "disabled",
        "oidc_login_provider_url": "***",
        "oidc_login_client_id": "***",
        "oidc_login_client_secret": "***",
        "oidc_login_auto_redirect": false,
        "oidc_login_end_session_redirect": false,
        "oidc_login_button_text": "***",
        "oidc_login_hide_password_form": false,
        "oidc_login_use_id_token": true,
        "oidc_login_attributes": {
            "id": "preferred_username",
            "name": "name",
            "mail": "email",
            "groups": "groups"
        },
        "oidc_login_default_group": "oidc",
        "oidc_login_use_external_storage": false,
        "oidc_login_scope": "openid profile email groups",
        "oidc_login_proxy_ldap": false,
        "oidc_login_disable_registration": true,
        "oidc_login_redir_fallback": false,
        "oidc_login_alt_login_page": "assets\/login.php",
        "oidc_login_tls_verify": true,
        "oidc_create_groups": false,
        "oidc_login_webdav_enabled": false,
        "oidc_login_password_authentication": false,
        "oidc_login_public_key_caching_time": 86400,
        "oidc_login_min_time_between_jwks_requests": 10,
        "oidc_login_well_known_caching_time": 86400,
        "oidc_login_update_avatar": false,
        "auth.webauthn.enabled": false,
        "updater.release.channel": "stable",
        "maintenance_window_start": 1
    }
}
Server log (data/nextcloud.log)
{"reqId":"mTljPx9xyzRSCDZpCj2O","level":1,"time":"2025-05-07T13:05:39+00:00","remoteAddr":"xxx","user":false,"app":"no app in context","method":"GET","url":"/index.php/apps/spreed/","message":"IP address throttled because it reached the attempts limit in the last 30 minutes [action: talkRoomToken, delay: 400, ip: xxx]","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0","version":"31.0.4.1","data":[],"id":"681b7f3693860"}
{"reqId":"Swg3OxlC33VBZ19K8JDa","level":1,"time":"2025-05-07T12:49:22+00:00","remoteAddr":"xxx","user":"xxx","app":"no app in context","method":"GET","url":"/ocs/v2.php/apps/spreed/api/v4/room/o4hmi5jj","message":"IP address throttled because it reached the attempts limit in the last 30 minutes [action: talkRoomToken, delay: 400, ip: xxx]","userAgent":"Mozilla/5.0 (Android) Nextcloud-Talk v21.0.1","version":"31.0.4.1","data":[],"id":"681b7f3694259"}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Start by tracing the talkRoomToken requests from /apps/spreed/ and /ocs/v2.php/apps/spreed/api/v4/room/... and compare them with the entries in data/nextcloud.log. Done means identifying why valid requests trigger IP-based bruteforce protection and verifying that affected WebDAV authentication is no longer blocked.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.