CVE-2012-4397

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in ownCloud versions prior to 4.0.1. The first two issues reside in the Calendar application's template files part.choosecalendar.rowfields.php and part.choosecalendar.rowfields.shared.php within apps/calendar/templates/, where the calendar displayname is echoed without proper sanitization [1][3]. The third issue is in apps/contacts/lib/vcard.php where unspecified vectors allow injection of arbitrary web script or HTML [1][4]. The affected versions include all ownCloud releases before 4.0.1.

Exploitation

An attacker can exploit these vulnerabilities by providing crafted input that includes malicious JavaScript or HTML. For the Calendar vectors, the attacker must be able to set the calendar display name (e.g., via sharing or creation) so that the unsanitized value is rendered in the victim's browser. For the Contacts vector, the attacker can inject malicious content into vCard properties that are then displayed to other users. No authentication is strictly required if the application permits unauthenticated creation or modification of calendar names or contact data; otherwise, a low-privileged authenticated user can trigger the payload when an administrator or other user views the affected pages.

Impact

Successful exploitation allows a remote attacker to execute arbitrary web script or HTML in the context of the victim's session. This can lead to theft of session cookies, data exfiltration, defacement, or further attacks against ownCloud users and the underlying system. The scope of impact depends on the privileges of the compromised user.

Mitigation

The vulnerabilities are fixed in ownCloud version 4.0.1 [1]. Users should upgrade to this or any later release. The commits fixing the Calendar XSS include using htmlspecialchars on the display name [3], and for Contacts, applying strip_tags to vCard property values [4]. No workarounds are described in the available references for earlier versions; upgrading is the recommended action.