How it was found

Product

Nextcloud – Tables App Section: Applications

Vulnerability Type

Client-side Denial of Service (DoS) Data Hiding / UI Logic Abuse Improper Input Validation

Description

In the Nextcloud Tables → Applications section, each Application has an icon. The backend allows updating this icon using the iconName parameter.

The application does not validate whether iconName is a valid icon.

If an attacker sends any invalid value, the backend accepts it, but the frontend crashes when rendering the application, causing:

• The application card not to load
• The application data to disappear
• The entire application UI to break

This effectively allows any user with edit access to hide all data in that application.

Impact

By setting an invalid icon:

• The entire application becomes unusable
• Users cannot see tables, records, or settings
• No error message explains what happened
• The data still exists, but is unreachable

This creates a persistent data-hiding attack.

Proof of Concept

Send the following request while editing an application:

PUT /ocs/v2.php/apps/tables/api/2/contexts/8 HTTP/1.1
Host: 127.0.0.1:8080
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Origin: http://127.0.0.1:8080

{"name":"pops","iconName":"asdsadasd","description":"","nodes":[{"id":17,"type":0,"permissions":7}]}

➡ iconName is set to a non-existent icon

Backend response: 200 OK

After reloading the Tables UI:

• The application does not render
• Data disappears
• UI is broken

Real-World Attack Scenario

1. A company uses Nextcloud Tables to store:

   • Financial records
   • HR data
   • Incident reports

2. A normal employee has edit access to an application.

3. The employee sends a request setting:

   iconName = "invalid_icon_value"
   

4. Result:

   • The whole application crashes for all users
   • Management believes the data is gone
   • Work is blocked
   • Panic and data-loss incident is triggered

This is a perfect sabotage attack inside an organization.

Root Cause

The backend:

• Accepts any iconName
• Does not validate against a whitelist

The frontend:

• Crashes when it cannot resolve the icon

Recommended Fix

On the backend:

• Validate iconName against a fixed list of allowed icons
• Reject invalid values with 400 Bad Request

On the frontend:

• Add a fallback icon if loading fails

Security Classification

CWE-20 – Improper Input Validation CWE-755 – Improper Handling of Exceptional Conditions

==The PoC Video==

{F5221111}