CVE-2012-5608

Vulnerability

A cross-site scripting (XSS) vulnerability exists in apps/user_webdavauth/settings.php in ownCloud versions 4.5.0 and 4.5.1. The script does not sanitize arbitrary POST parameters, allowing an attacker to inject arbitrary web script or HTML [1]. The issue was assigned oC-SA-2012-003 and fixed in ownCloud 4.5.2 [1][3].

Exploitation

An attacker can send a crafted POST request to the vulnerable settings.php endpoint with malicious JavaScript or HTML in any POST parameter. No authentication is required to deliver the payload, but the injected script executes only when an administrator or user visits the affected settings page, making it a stored or reflected XSS depending on the context [1].

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the context of the victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive data within the ownCloud application [1].

Mitigation

The vulnerability is fixed in ownCloud version 4.5.2 [1][3]. Users should upgrade to this version or later. The fix is also visible in the commit that removes debug output from the affected file [2]. No workarounds are documented in the available references.