Nextcloud · Report #575562
Blind Stored XSS on iOS App due to Unsanitized Webview
Validstatus
lowseverity
$100bounty
28upvotes
7 Mar 2020disclosed
Summary
I found this bug while try to learn from awesome Blind XSS writeup from omespino. As a newbie, all I have to do is following his writeup. Every payload material that I used is credited to him.
How it was found
Hi Team!
I found a Blind XSS can executed on iOS App due to unsanitized webview. Using this issue, attacker can extract information from victim.
Steps To Reproduce:
- Upload malicious HTML, share to victim
- Waiting victim to open it
{F487447}
{F487448}
HTML payload attached, don't forget to change IP Address to yours.
Recomendation: Disabling Javascript on Webview Reference: https://developer.apple.com/documentation/webkit/wkpreferences#//apple_ref/occ/instp/WKPreferences/javaScriptEnabled
Impact
In this PoC, attacker can extract information from victim such as IP Address, Location, OS.