< go back to overview

Stored XSS in gallery application

Platform: ownCloud Server

Versions: 9.0.4,

Date: 7/19/2016

Risk level: Medium

CVSS v3 Base Score: 6.4 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N)

CWE: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (CWE-79)

HackerOne report: 145355

Description

Due to a recent migration of the Gallery app to the new sharing endpoint a parameter changed from an integer to a string value. This value wasn’t sanitized before and was thus now vulnerable to a Cross-Site-Scripting attack.

To exploit this vulnerability an authenticated attacker has to share a folder with someone else, get them to open the shared folder in the Gallery app and open the sharing window there.

Since ownCloud employs a strict Content-Security-Policy this vulnerability is only exploitable in browsers not supporting Content-Security-Policy. You can check at caniuse.com whether your browser supports CSP.

Affected Software

Action Taken

The user input is now properly sanitised before being provided back to the user.

Acknowledgements

The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:

Share this

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close