Bookmarks: Delete all existing bookmarks of a user

Disclosed: 2016-08-08 09:28:32 By ctee To nextcloud
Unknown
Vulnerability Details
A logical bug in the bookmark app makes it possible to delete all the existing bookmarks of the user. Here are the steps to reproduce: - Create couple of valid bookmarks - Import a bookmark.html file that contains the line **<a href="">Bookmark</a>**. All the bookmarks of the user is replaced with blank url and Bookmark as description. - This is potentially a risk where a user could be sent malicious html file to delete the bookmarks or this could even happen unintentionally if the user uploads a html with blank urls. The logical flaw resides in the method **/apps/bookmarks/controller/lib/bookmarks.php** -> **addBookmark** where SQL query will select all the bookmarks and update them.
Actions
View on HackerOne
Report Stats
  • Report ID: 154529
  • State: Closed
  • Substate: resolved
  • Upvotes: 4
Share this report