Email Spoofing Vulnerability from nextcloud.
High
N
Nextcloud
Submitted None
Actions:
Reported by
cloudyvirus
Vulnerability Details
Technical details and impact analysis
Hi nextcloud,
Here is Shaifullah Shaon (Black_EyE), An Ethical Hacker.
a white hat cyber security researcher from Bangladesh reporting a serious
[3'rd ranking in OWASP] security vulnerability on your system.
There is an Email Spoofing Vulnerability from nextcloud.
Steps to reproduce:
1) Go to http://emkei.cz/
2) Fill "From Email" field to [email protected] or any other nextcloud email.
3) Fill the victim's address (your address) to "TO" field and fill in other details as you wish.
You will receive email from nextcloud Support Team.
Recheck it,
Reference:
https://hackerone.com/reports/575
https://hackerone.com/reports/182467
Thank you for time and consideration you provided for reading my report.
Note: If you don't find it in your inbox, see spam folder. If the victim is using
Gmail account it might be in spam folder. In other mailing service like nextcloud it is
directly recieved in inbox.
Proof as Video Concept (unlisted): https://youtu.be/yPAcyydlaMg
NB: If you Informative it, Then Want to told you that, Today or tomorrow Wannacry Ransomware are shared by email spoofing. Remember it.
Your sincerely,
Shaifullah Shaon
[email protected]
Report Details
Additional information and metadata
State
Closed
Substate
Spam