Nextcloud 路 Report #3599470
Improper input validation in emoji field leads to sidebar UI denial of service
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4vpp-fp9q-9g23
How it was found
Summary:
The emoji field in the page emoji update endpoint does not properly validate user input. An attacker can submit an excessively long string including newline characters instead of a valid emoji. By injecting long text and line breaks, the sidebar layout becomes broken. As a result, the malicious page icon overlaps other items in the sidebar, preventing users from clicking or accessing other pages.
Version:
==Collectives app: 4.0.0==
Steps To Reproduce:
- User A creates a page inside a collective.
- User A shares the page with User B and grants edit permission.
- User B sends the following request to update the page emoji:
PUT /ocs/v2.php/apps/collectives/api/v1.0/p/collectives/{collective_id}/pages/{page_id}/emoji
Content-Type: application/json
Example payload:
{
"emoji": "馃憤aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
{F5516905} 4. After the request is processed, open the collective sidebar. 5. Observe that the emoji icon becomes extremely large due to the injected content, breaking the sidebar layout. 6. The malformed icon overlaps other sidebar items, preventing users from clicking or accessing other pages.
{F5516922}
Impact
- An attacker with permission to modify a page emoji can inject long malformed input that breaks the sidebar layout. This may block access to other pages in the collective, effectively causing a UI-based denial of service for users trying to navigate the workspace.