Nextcloud · Report #658011

Clickjacking on https://download.nextcloud.com

Duplicatestatus

1upvotes

11 Nov 2019disclosed

How it was found

This page is vulnerable to clickjacking https://download.nextcloud.com

Steps to Reproduce:

Copy the following code and save it as clickjacking.html

<html> <head> <title>Clickjack test page</title> </head> <body> <p>Website is vulnerable to clickjacking!</p> <iframe src="https://download.nextcloud.com" width="500" height="500"></iframe> </body> </html>

Open it in browser

You can see the website is vulnerable to clickjacking

Impact

Anyone can be tricked to download files without their intention

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original