demo.nextcloud.com: Content spoofing due to default Apache Error Page
N
Nextcloud
Submitted None
Actions:
Reported by
sysecure
Vulnerability Details
Technical details and impact analysis
Hi ,I would like to report report a text injection and a miss-configuration of the 403 page which can be used in phishing.
POC:
https://demo.nextcloud.com//this%20website%20-----------------------------------------------------------------------------------------------------------------------------------------------------------------------%20thanks%20for%20visiting%20our%20website,becase%20we%27re%20having%20some%20problems%20we%20have%20been%20moved%20to%20this%20site%20http:/www.malicious.com%20please%20note%20that%20our%20website%20is%20no%20longer%20exist%20Fix%20:
Just use a 403 page that don't include attacker text just as hackerone do
or just as you do in your in other not found pages.
Thanks !
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Violation of Secure Design Principles