CVE-2021-32733 XSS in Nextcloud Text application

Medium 4.8 Published 12 Jul 2021 Updated 3 Aug 2024

An XSS vulnerability in Nextcloud Text allows attackers to execute scripts, though modern CSP mitigates this risk.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-32733?

CVE-2021-32733 is a medium-severity cross-site scripting vulnerability in Nextcloud Nextcloud Server, published on 12 Jul 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, use a browser that has support for Content-Security-Policy.

Weakness: CWE-79

Which versions are affected by CVE-2021-32733?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2021-32733?

No fix has been published for CVE-2021-32733 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-32733 being exploited?

There is no known exploitation of CVE-2021-32733 in the wild and no public exploit code.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-x4w3-jhcr-57pq.