Listen to this Post
The vulnerability exists within the organisation and fields of a user’s contact card in the Nextcloud Contacts app. A malicious user with edit permissions to their own card can inject a crafted payload into these fields. While the Nextcloud Server’s Content Security Policy (CSP) effectively blocks the execution of JavaScript, it does not restrict the loading of external Cascading Style Sheet (CSS) resources. By setting the organisation or to a value containing a `` tag, the attacker can force the Nextcloud interface to load a CSS file from a server they control when the card is viewed by an administrator or another user. This allows for limited but impactful attacks such as conducting UI redress (clickjacking) to disguise elements, extracting sensitive data via CSS-based exfiltration techniques that detect attribute values, or manipulating the page’s appearance to facilitate phishing within the trusted Nextcloud context.
Platform: Nextcloud Contacts
Version: <5.5.4 <6.0.6 <7.2.4
Vulnerability: CSS Injection
Severity: High
Date: 2025-12-05
Prediction: Patched (2025-12-05)
What Undercode Says:
Analytics
Check installed app version occ app:get contacts version Grep for relevant field processing grep -r "organisation|" apps/contacts/lib/
How Exploit:
1. Attacker edits profile.
- Injects `` into organisation field.
3. Admin views attacker’s contact card.
- Malicious CSS loads, enabling exfiltration or UI manipulation.
Protection from this CVE
Update to Contacts app version 5.5.4, 6.0.6, or 7.2.5. Enforce strict input validation and sanitization on all user-provided fields that are rendered in web views.
Impact:
Phishing facilitation, Sensitive data leakage, UI manipulation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
