Nextcloud · Report #146278
Log pollution can lead to HTML Injection.
Summary
The "download log" functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as HTML document. Thus any injected data in the log would be executed.
While the document would only be executed locally (thus on another scope) we have decided to fix this to protect our users.
A detailed advisory can be found at https://nextcloud.com/security/advisory/?id=nc-sa-2016-002.
Thanks a lot, @apok for pointing out this vulnerability!
How it was found
Hi Team, I was looking around in your app and on the log part (accessed by the admin), I noticed that the log file is downloaded as an HTML file. Naturally I started trying to inject code I noticed that when HTML code is inserted, a HTML comment start tag is inserted. But I was able to bypass this protection by inserting a comment end tag and then the HTML code, which resulted in HTML injection.
To reproduce this behaviour I started looking where a user is able to inject data onto the log file, and I noticed that when the "Host" header is different from the one configured for the app, a warning is injected onto the app. There likely many other sections that could serve to inject into the log, but I've just started to analyze the app so I couldn't find any yet.
Proof of Concept:
- Generate the following request to the server: GET /nextcloud/index.php HTTP/1.1 Host: -->test"<img src=a onerror=alert('xss')> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.7,es-AR;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive
- Download the log file.
- Observe that the code is executed properly.
Why is this a vulnerability? A malicious individual could use this to execute malicious code on an administrator that happened to open the downloaded Log file.
How to fix?: We can defeat this attack by adding an additional filter on the log file which escapes html special characters.
I'm sending a couple of screenshots. I'll keep digging and if I find anything else I'll send you another report.
Kind Regards, Apok.