HexBrain

ownCloud · Report #112304

owncloud.help: Text Injection

Validstatus
23 Jan 2016disclosed

How it was found

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing Text injection can be used in phishing 404 page should not include attacker text

The bug exists at :

https://owncloud.help/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20one

as you can see attacker text is included "It has been changed by a new one https://www.crowdcurity.com so go to the new one since this one was not found on this server."

Fix : just use a 404 page that don't include attacker text just as : hackerone.com,bugcrowd.com do (a 404 page that don't include any externel text hope you fix it

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original