Executive brief
nextcloud-vue-collections is a Vue component library used by Nextcloud applications to display user collaboration collections. A Cross-Site Scripting (XSS) vulnerability in the tooltip component allows attackers to inject malicious JavaScript code that executes in a user's browser when they interact with collection items, potentially enabling account compromise or data theft.
Technical details
The vulnerability is a stored/reflected Cross-Site Scripting (CWE-79) in the v-tooltip component's defaultHtml configuration. The component insecurely allows arbitrary HTML and JavaScript to be rendered in tooltips displayed for collection items. An attacker can craft malicious input in a collection item's tooltip field to execute arbitrary JavaScript in a victim's browser context. The vulnerability affects all versions prior to 0.4.2, and is fixed by explicitly disabling the defaultHtml setting in the tooltip directive. No authentication or special preconditions are required beyond normal interaction with the affected component.
Affected products
- Nextcloud nextcloud-vue-collections <0.4.2
Timeline
- 2020-09-04: disclosed
- 2020-08-31: patched: Fix committed to main branch; version 0.4.2 released with XSS mitigation