nextcloud-whitelist

1name: crowdsecurity/nextcloud-whitelist
2description: "Whitelist events from nextcloud"
3filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"1
4whitelist:
5  reason: "Nextcloud Whitelist"
6  expression:
7   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.file_ext == '.vcf' && evt.Parsed.http_args contains "photo" #Contacts app .vcf missing photo
8   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/files_versions/preview' && evt.Parsed.http_args contains 'version' #Backup app missing file version
9   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/photos/api/v1/preview' && evt.Parsed.http_args contains 'x' && evt.Parsed.http_args contains 'y' #Photo app loads all previews as small panes, but can 404
10   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.request contains '/core/preview' && evt.Parsed.http_args contains 'x=' && evt.Parsed.http_args contains 'y=' && evt.Parsed.http_args contains 'fileId=' #File preview often 404s while searching
11   - evt.Meta.http_status in ['404', '200'] && evt.Meta.http_verb in ['PROPFIND', 'GET', 'DELETE'] && evt.Meta.http_path matches '^/remote.php/(web)?dav/' #Uploading new files via WebDAV always produces a 404
12   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'PROPFIND' && evt.Parsed.file_dir startsWith '/public.php/webdav/' && lower(evt.Parsed.file_name) in ['readme.md', 'lisez%20moi.md'] # Resharing scans for readme to check existence
13   - evt.Meta.http_status in ['200', '204', '404', '400'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path matches '/apps/mail/api/avatars/(url|image)/' #When loading mail contacts the avatars may get 404, or if you have a lot of contacts, it may trigger crawl-non-static
14   - evt.Meta.http_status == '200' && evt.Parsed.static_ressource == 'false' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/photos/api/v1/preview' && evt.Parsed.http_args matches '(^|&)x=\\d+' && evt.Parsed.http_args matches '(^|&)y=\\d+' #When loading multiple images inside Nextcloud Photos, HTTP Crawl non statics is triggered since the images look like dynamic assets. Recent Photos versions no longer send etag and put x first (?x=512&y=512).
15   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.request matches '/ocs/v2.php/apps/text(/public)?/workspace' && evt.Parsed.http_args contains 'path=%2F' #When opening folders in Nextcloud Files that don't contain a readme.md 404 error is thrown
16   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/files_trashbin/preview' && evt.Parsed.http_args contains 'fileId=' # 404 error thrown when preview is missing for files in trash bin
17   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path matches '\\/apps\\/files\\/api\\/v1\\/thumbnail\\/(\\d+)/(\\d+)'
18   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/bookmarks/bookmark' && (evt.Meta.http_path endsWith 'favicon' || evt.Meta.http_path endsWith 'image') #When loading NC bookmarks: some entries might have no favicon or no image
19   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/bookmarks/folder' && evt.Meta.http_path endsWith 'publictoken' #When loading NC bookmarks: private folders have no publictoken
20   - evt.Meta.http_status == '403' && evt.Meta.http_verb in ['GET', 'PUT'] && evt.Meta.http_path matches '\\/apps\\/mail\\/api\\/messages\\/(\\d+)\\/(flags|dkim|itineraries)' #When loading mail messages, some requests are forbidden due to message deletion by another user in shared inboxes
21   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/files_sharing/publicpreview' && evt.Parsed.http_args matches 'x=\\d+' && evt.Parsed.http_args matches 'y=\\d+' #Public preview thumbnail in files sharing app can 404 if file cannot be a thumbnail
22   - evt.Meta.http_status == '403' && evt.Meta.http_verb == 'POST' && evt.Meta.http_path matches '\\/apps\\/text\\/session\\/(\\d+)\\/push' #When attempting to push changes to a session that has expired
23   - evt.Meta.http_status == '304' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/avatar' #When loading avatars in Nextcloud Talk, the request may return a 304 Not Modified if the avatar has not changed
24   - evt.Meta.http_status == '400' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/mail/api/messages' #When loading mail messages, the request may return a 400 Bad Request
25   - evt.Meta.http_status == '403' && evt.Meta.http_verb == 'POST' && evt.Meta.http_path matches '\\/apps\\/mail\\/api\\/mailboxes\\/(\\d+)\\/sync' #Mail mailbox sync can 403 for a mailbox the account can no longer read
26   - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/richdocumentscode/proxy.php' && evt.Parsed.http_args contains 'req=' #Collabora/richdocumentscode uses proxy.php to access resources, some may 404 if missing
27   - evt.Meta.http_verb == 'GET' && evt.Meta.http_status in ['200', '303', '304', '499'] && (evt.Meta.http_path matches '\\/apps\\/music\\/api\\/cover\\/[a-f0-9]+' || evt.Meta.http_path matches '\\/apps\\/music\\/api\\/albums\\/(\\d+)\\/cover') # allow Nextcloud Music