A few weeks ago there was a bit of a hype about ownCloud when they released version 3.0.1. I decided to give it a spin, here is what I found.
Note: I contacted the development team earlier and these vulnerabilities have been fixed in the meantime with version 3.0.2, although I have not confirmed this myself due to lack of time.
XSS in files/download.php
The attacker can send an URL to the victim and JavaScript will be executed in the victims session. The attacker does not need an account on the ownCloud instance, only knowledge about the URL path:
http://localhost/owncloud/files/download.php?file=/xss.png%3Cscript%3Ealert(1)%3C/script%3E
XSS in files/index.php
If you share your ownCloud instance with multiple users, the attacker can send an URL to the victim and JavaScript will be executed in the victims session. Both the attacker and victim need accounts on the same instance.
Here is how:
1) Create a new folder on http://localhost/owncloud/files/index.php – any name will do, I used “PoC”
2) Share this folder with your victim or the victims group
3) Switch to http://localhost/owncloud/files/index.php?dir=/PoC
4) Create a folder, called:
x"> <body onload=alert(1)><x="
5) Send that link to your victim:
http://localhost/owncloud/files/index.php?dir=/Shared/PoC/x%22%3E%20%3Cbody%20onload%3Dalert%281%29%3E%3Cx%3D%22
6) ???
7) Profit!
It may be possible to create the folder directly in /, however I couldn’t get that folder shared with other users. But since it gets automatically shared if the parent folder is shared, I didn’t invest much time into that.
XSS in apps/contacts/index.php
I found another XSS flaw in the Contacts function, creating a contact and adding this in any field:
foo"><script>alert(1)</script>
will also execute. However, since you cannot share contacts between users (or can you?) I believe this is a minor problem.