Nextcloud · Report #271253
NextCloud is also Accepting OCTET-STREAM Type of Documents instead of jpg or Imge Files Only
Duplicatestatus
7upvotes
11 Apr 2019disclosed
How it was found
Summary: I noticed that NextCloud is accepting OCTET-STREAM Type of Files Where you have Background/Logo Upload Option. I Believe that NextCloud is Checking for Such Type of Files but i can upload application/octet-stream Type of Documents by Crafting a Special Type of File (In this case i created a .bat file and attached a image into it) and your system accepted that file. Please Check Snapshot for more info.
How to Reproduce
- Go to this URL : settings/admin/theming
- You will get a option Upload Background PIC
- Now open your Chrome Console Network tab to see what type of file is it.
- Download my attached file "background.bat" and try to upload it there
- File will be accepted by NextCloud and you can see type of file is OCTET-STREAM in Networks tab of Chrome Console