Nextcloud: Content Spoofing/Text Injection in nextcloud.com

Greetings, Hello Team, I have found a Content Spoofing/Text Injection on this domain https://nextcloud.com PoC URL: https://nextcloud.com/wp-content/cache/minify/%0d%0ahas%20moved%20to%20www.attacker.com.Please%20visit%20attacker.com%20present%20resource PoC Screen Shot: F168750 Let me know if yo...

Nextcloud: SSRF at apps.nextcloud.com/developer/apps/releases/new

Hi, I've found SSRF vulnerability at https://apps.nextcloud.com/developer/apps/releases/new Description Server Side Request Forgery SSRF is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server. Usually, Server Side Request Forgery SSRF attack...

Nextcloud: DOM XSS vulnerability in search dialogue (NC-SA-2017-007)

DOM XSS vulnerability in search dialogue NC-SA-2017-007 Risk level: Low CVSS v3 Base Score: 2.6 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CWE: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CWE-79 Description Inadequate escaping lead to XSS vulnerability in the searc...

Nextcloud: Invalid request may lead content spoofing for phishing

HI, I found that site have invalid request may lead to content spoof. Proof Of Concept: https://logs.nextcloud.com/redirecturi?Andmovet0malicioussite.com Thanks,...

Nextcloud: Content spoofing due to the improper behavior of the 403 page

Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. PoC:...

Nextcloud: https://xmpp.nextcloud.com///;@www.google.com allows open redirect

Good day : Hope it goes well, an open redirect exists on the main xmpp.nextcloud.com domain allowing "bad hackers" to do bad things : Poc https://xmpp.nextcloud.com///;@www.google.com May you be well on your side of the screen : -Eric...

Nextcloud: Version 4.7.2 of wordpress is vulnerable

Hello team, I observed that your website https://nextcloud.com still use wordpress 4.7.2 Version 4.7.2 of wordpress is vulnerable to : Cross-site scripting XSS Control characters can trick redirect URL validation Cross-site scripting XSS via video URL in YouTube embeds Cross-site scripting XSS vi...

Nextcloud: http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacement

Good day, I truly hope it treats you well on your side of the screen : I have found that your website uses the flash file: swfupload.swf to allow your users to upload files. The tl;dr version of this bug report is it allows an open redirect to any site a non kind person may want to exploit or...

Nextcloud: LDAP login possible even though account doesn't match user filter

We have set up a ldap user filter to match only those users in our ldap directory which should get access to nextcloud. User count shows correct number of users as expected and the filter correctly shows only the users we want in an ldapsearch. The ldap directory contains a lot of other accounts...

Nextcloud: Missing SPF Flags on nextcloud.com

Hello NextCloud Details i just test your domain which is nextcloud.com and i surprised that i can send a legit email to a user. Impact Attacker can use this to send a Legit Email to the Victim and attacker can send a Malicious Web Links and Phishing Sites. Video Proof of Concept...

Nextcloud: Calendar and addressbook names disclosed (NC-SA-2017-012)

Calendar and addressbook names disclosed NC-SA-2017-012 Risk level: Low CVSS v3 Base Score: 3.5 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CWE: Information Exposure Through Directory Listing CWE-548 Description A logical error caused disclosure of calendar and addressbook names to other logged-in users...

Nextcloud: Wordpress 4.7.1

Greetings, I observed that your website https://nextcloud.com still use wordpress 4.7.1 + WordPress version 4.7.1 Released on 2017-01-11 identified from advanced fingerprinting This version of wordpress is vulnerable to : ---- - WPQuery SQLi injection - XSS vulnerability was in the posts list tab...

Nextcloud: Email Spoofing

Hi there, Similar to this report submitted to Hackerone itself: https://hackerone.com/reports/575 You also are vulnerable to email spoofing. Steps to reproduce: 1- Go to https://emkei.cz A Fake Mailer 2- Set the from to parameter as [email protected] or any other name, and send it. 3- The ema...

Nextcloud: Missing Rate Limit for Current Password field in nextcloud.com

There is no rate limit enabled for "Current Password" field on Setting page of nextcloud.com. A malicious minded user can continually tries to brute force an account password...

Nextcloud: Nextcloud.com is vulnerable to SWEET32 attack

Researchers have found new attack against 3DES-CBC cipher in TLS,that they can decrypt customer data using a method called SWEET32 Birthday Attack. This Vulnerability has got CVE-2016-2183 and has cvss score 5.0 This vulnerability can be found manually by simply using nmap script nmap -Pn -p...

Nextcloud: Group admin can remove user from all his groups via API

Steps 1. As admin make user1 group admin for group1 and group2 2. As user1 create a new user user2 3. As user1 try to remove the user from both groups via the UI 4. Take the first togglegroup.php request and replay it with group2 on curl Expected Should not work Actual The group-admin can escape...

Nextcloud: Drone Nextcloud

Greetings, On drone : https://drone.nextcloud.com We observe this : ---- F152818 I noticed that it's possible to alter the url to write what you want : ---- https://drone.nextcloud.com/rbcafe/settings/settings/badges F152817 In fact it could be anything : ----...

Nextcloud: HTTP-Basic Authentication on logs.nextcloud.com

Greetings, While visiting https://logs.nextcloud.com/ , I noticed that this server use HTTP-Basic Authentication. F152730 POC : ------ GET https://logs.nextcloud.com/ HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:50.0 Gecko/20100101 Firefox/50.0 Accept:...

Nextcloud: Disclosure of administrators via JSON on nextcloud.com Wordpress

@rbcafe reported the following issue, since it contains references to internal data we've decided to disclose this issue only limitedly. ------- Greetings, Description : ---------------- Since the update of the website to wordpress 4.7 the JSON discloses administrators : POC : ----------------...

Nextcloud: WordPress <= 4.6.1 Stored XSS Via Theme File

Hello Team, Description:- Vulnerable code is located at /wp-admin/includes/class-theme-installer-skin.php POC:- https://nextcloud.com/readme.html F151887 FIX:- Upgrade wordpress to latest Refer:- https://wpvulndb.com/vulnerabilities/8718 https://www.mehmetince.net/low-severity-wordpress/ Attack...