Nextcloud: demo.nextcloud.com: Content spoofing due to default Apache Error Page

Hello there , your site is vulnerable to phishing the users by this vulnerability. proof of concept...

Nextcloud: Arbitrary File Upload in Logo & Log in image Theming setting.

Hi team First I think this vulnerability doesn't fall at your bug bounty program but this is a bad design that should fix right now cause if an attacker get admin access he still can upload a malicious file in client server side. I saw that Logo & Log in image allow to upload other files type...

Nextcloud: demo.nextcloud.com: Content spoofing due to default Apache Error Page

Hi ,I would like to report report a text injection and a miss-configuration of the 403 page which can be used in phishing. POC:...

Nextcloud: More content spoofing through dir param in the files app

Hi! It's still possible to use an invalid dir param to spoof messages in the directory breadcrumbs area. For example, you can use URL-encoded periods to bypass the directory traversal prevention. By referencing a path that returns a 301, you can add a message in the dir param F108266:...

Nextcloud: Bookmarks: Delete all existing bookmarks of a user

A logical bug in the bookmark app makes it possible to delete all the existing bookmarks of the user. Here are the steps to reproduce: - Create couple of valid bookmarks - Import a bookmark.html file that contains the line Bookmark. All the bookmarks of the user is replaced with blank url and...

Nextcloud: IDOR - Disable sharing

Decription: ----- Users are shared files or folder. can disable this sharing. Detail: ------ + use request: DELETE /nextcloud/ocs/v2.php/apps/filessharing/api/v1/shares/share-id?format=json HTTP/1.1 Host: your-host User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:47.0 Gecko/20100101 Firefox/47....

Nextcloud: xss for admin of https://newsletter.nextcloud.com

a site https://newsletter.nextcloud.com to have phplist 3.2.5 steps to reproduce: 1. to use firefox browser, latest version 2. go to https://newsletter.nextcloud.com/admin/?page=viewtemplate&id=123%22%3E%3Cscript%3Ealertdocument.domain%3C/script%3E 3. log in as admin 4. alert box with name of...

Nextcloud: [Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter

@ahsantahir reported a low severity content spoofing vulnerability in an administrative component. We've mitigated the issue as a hardening in our upcoming Nextcloud 11 release and would like to thank @ahsantahir for reporting this issue to us. On request of the reporter this issue is only...

Nextcloud: Content spoofing in cloud.nextcloud.com

@ahsantahir reported a content spoofing vulnerability in cloud.nextcloud.com caused by it's Apache configuration. This has been changed by adding the following to the Apache config: ErrorDocument 404 "File not ErrorDocument 403 "Access forbidden." On request of the reporter, this issue is only...

Nextcloud: Information disclosure

Hello Nextcloud go to https://help.nextcloud.com/users/.json for example https://help.nextcloud.com/users/amirie.json you can see the user information...

Edit permission check not enforced on WebDAV COPY action - ownCloud

The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files. Affected Software ownCloud Server 9.0.4 CVE-2016-????...

Read-only share recipient can restore old versions of file (NC-SA-2016-005)

The restore capability of Nextcloud was not verifying whether an user has only read-only access to a share. Thus an user with read-only access was able to restore old versions...

Nextcloud: Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/

Dear Next Cloud Security Team, I would like to report an issue. This is not a critical issue since the affect and not even "touch" something sensitive that stored at the server via the application. As a summary, this is issue need the user interaction for exploiting the "target". So, based on thi...

Nextcloud: [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS

I found stored XSS vulnerability in nextcloud server's chat module Nextcloud Server version - 9.0.51 OS - Ubuntu 14.0.4 Browser - Internet Explorer 11 Steps: 1 Login as non-admin userattacker and change full name containing XSS payload - elamaran'"alertdocument.domain 2 Login as...

ownCloud/Nextcloud Unprotected Data Directory (HTTP)

ownCloud/Nextcloud is exposing an unprotected data directory. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Nextcloud: No Rate Limiting on stats.nextcloud.com login

There is no defenses or any lockout mechanism on stats.nextcloud.com login , a malicious minded user can continue guessing an account password limitless, and this might cause to completely compromised the site. Recommendation: Put a rate limit or a any lockout mechanism Regards Japz...

Nextcloud: Deny access to download.nextcloud.com + folders

hi, you should to deny access here: https://download.nextcloud.com/ + all folders because everyone can see your files on the server. this is not a bug, but it's important to keep secret your files. to resolve this issue: In an .htaccess file you need to use: Deny from all regards armfox97...

Nextcloud: Log pollution can lead to HTML Injection.

Hi Team, I was looking around in your app and on the log part accessed by the admin, I noticed that the log file is downloaded as an HTML file. Naturally I started trying to inject code I noticed that when HTML code is inserted, a HTML comment start tag is inserted. But I was able to bypass this...

Nextcloud: REG: Content provider information leakage

Issue : While analyzing your code of manifest.xml i found a issue related to content provider information leakage . Issue description : Your content provider settings will allowing any other app on the device to access it AndroidManifest.xml. You should modify the attribute to exported="false" or...

Nextcloud: Authentication Issue

UserA creates a password protected share 2. UserA shares this link with UserB 3. UserB accessed the share with the password 4. UserA changes the password 5. Now userB can still access the share. At step 5 userB should be prompted to authenticate again...