CVE-2012-5666

Vulnerability

The bookmarks app in ownCloud versions 4.0.x before 4.0.10 and 4.5.x before 4.5.5 contains a reflected cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js. The updateBookmarksList function constructs an HTML anchor tag using String(window.location) without proper escaping, allowing an attacker to inject arbitrary HTML or JavaScript via the PATH_INFO parameter when accessing apps/bookmark/index.php. [1][2][3][4]

Exploitation

An attacker can craft a URL with malicious code in the PATH_INFO segment. When a victim visits the crafted URL, the window.location value (which includes the attacker-controlled path) is inserted into the page's DOM without sanitization, causing the injected script to execute in the victim's browser. No authentication is required; the attack only requires the victim to click the malicious link. [1][2]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's ownCloud session. This can lead to session hijacking, data theft, or defacement of the ownCloud interface. The attack is reflected (non-persistent) but can be used to steal credentials or perform actions on behalf of the victim. [1][2]

Mitigation

The vulnerability is fixed in ownCloud 4.0.10 and 4.5.5, released on December 21, 2012. The fix adds escapeHTML() to the window.location string before using it in the bookmark tag link (see commits [3] and [4]). Users should upgrade to the patched versions. No workaround is documented. [1][2][3][4]