ownCloud · Report #92111
Self-XSS in mails sent by [email protected]
Summary
@00day has reported a missing sanitization of names included in mails sent by [email protected].
If an user has configured their name to include a XSS payload this would be included within the mail sent to the user. This could lead to Javascript getting executed if the mail client is configured to execute Javascript. Due to the fact that this is input supplied by the user themselves we do consider this a low severity impact configuration issue.
We have been working together with the third-party providing the [email protected] service to us to make sure that in the future new user names are not used in vulnerable contexts like this. Unfortunately this does not apply to already created user names.
How it was found
Hello i create account with username have a payload code "><img src="c" onerror=alert(1)><script>alert(1)</script>, and i always when i get mail from [email protected] i get mail win inject the code payload (html code inject) From: ownCloud [email protected] Reply-To: [email protected] To: [email protected] Message-ID: 1443803020209.163f96fc-108e-42bf-8c10-86406627607e@smtp.hubapi.com Subject: ownCloud Security & Encryption 2.0; A Technical Overview MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_2297473_416570165.1443803059574" List-Unsubscribe: mailto:[email protected], <http://t.hsms06.com/e1t/c/*W4Zt7h03lnvKlW7vlbtK3d_CYy0/*W48wfbt6qPs7GW8WTnbw5F30_R0/ ------=_Part_2297473_416570165.1443803059574 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable
Hi "><img src=3D"c" onerror=3Dalert(1)><script>alert(1)</script>,
PoC image
Thanks
Hadji Samir