Nextcloud · Report #145374

Content Spoofing

Validstatus

3upvotes

19 Jun 2016disclosed

How it was found

Hi i got content spoofing vulnerability .

Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application.

POC Link :- https://nextcloud.com/.htacess%20THIS%20IS%20CONTENT%20SPOOFING

Possible Fix: URL Encode spaces to %20 which will convert spoofing content look like link

Cheers!

Ashish Pathak

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original