Bypass of privacy filter / tracking pixel blocker

How it was found

Description

When the mail app receives inline images, it will block them for privacy reasons to prevent tracking pixels (The images have been blocked to protect your privacy).

This block works correctly for most remote resources (in addition to images, remote CSS files, iframes, and some CSS attributes are also blocked).

However, it is still possible to inject images via some CSS attributes (specifically, list-style-image and background-image), thus bypassing the block and enabling tracking of users.

POC

Send a mail with the following body to an email address that is connected to Nextcloud Mail (the HTML code can for example be sent via thunderbird by clicking insert -> HTML):

    <style>
        big {
            background-image: url(https://www.google.com/logos/doodles/2021/celebrating-frank-kameny-6753651837108392-l.png);

        }
        ul {
            list-style-image: url(https://www.google.com/logos/doodles/2021/celebrating-frank-kameny-6753651837108392-l.png);
        }
    </style>
    <big>test</big>

    <ul>
      <li>Item 1</li>
      <li>Item 2</li>
    </ul>

Open the message to see that the remote image is included directly, bypassing the privacy filter. An attacker can now replace www.google.com with a log server they control to log when users open the mail.

Impact

bypass of image privacy filter which prevents tracking scripts from gathering users IP addresses and information on when they view an email.