CVE-2012-5606

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in ownCloud versions before 4.0.9 and 4.5.0. The flaws occur in three locations: file names in apps/files/js/filelist.js and apps/files_versions/js/versions.js, and event titles in 3rdparty/fullcalendar/js/fullcalendar.js. User-supplied input is not sanitized before being inserted into HTML, allowing injection of arbitrary web script or HTML. [1][2][3][4]

Exploitation

An attacker can exploit these vulnerabilities by uploading a file with a malicious name or creating an event with a malicious title. No authentication is required if the ownCloud instance allows public file uploads or event creation. When a victim views the file list or calendar, the injected script executes in their browser context. [1][2][3][4]

Impact

Successful exploitation enables cross-site scripting (XSS), allowing the attacker to steal session cookies, perform actions on behalf of the victim, or deface the page. The impact is confined to the victim's browser session and the ownCloud instance's domain. [1]

Mitigation

The vulnerabilities are fixed in ownCloud 4.0.9 and 4.5.0, released in November 2012. Users should upgrade to these versions or later. No workarounds are documented. The fix introduces escapeHTML() and htmlEscape() functions to sanitize output. [1][2][3][4]