# Log pollution can lead to HTML Injection.

Host header injected into Nextcloud admin log; downloaded log opened as HTML in Firefox on Windows executes injected img onerror XSS.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: apok
- Disclosed: 2016-07-19
- CVE: CVE-2016-9459
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/146278
- Library page: https://bugbountylibrary.com/r/h1%3A146278
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:crlf-injection vuln:host-header vuln:xss

**Target:** Admin log download endpoint / log file rendering
**Root cause:** Log entries are wrapped in an HTML comment start tag but not escaped; a comment-end tag in attacker-controlled log data (Host header) breaks out, and the downloaded log is rendered as HTML by Firefox on Windows.
**Steps:**
1. Send `GET /nextcloud/index.php HTTP/1.1` with `Host: -->test"<img src=a onerror=alert('xss')>` to trigger a host-mismatch warning written to the log.
2. As admin, download the log file from the admin log section.
3. Open the downloaded file in Firefox on Windows; the injected img onerror executes.
**How found:** Noticed the admin log is downloaded as an HTML file; tried injecting HTML, saw a comment start tag prepended, bypassed it by first inserting a comment end tag, then searched for a log-injectable input and found the Host header mismatch warning.
**Exploitation:** Attacker sends a request with a crafted Host header that gets logged as a warning; admin downloads the log and Firefox on Windows offers to open it as HTML, executing the injected script in local file scope.
**Insight:** When a log viewer wraps entries in HTML comments, a comment-terminator in any logged field escapes the wrapper; look for attacker-controlled fields (Host, User-Agent, Referer) that get logged and check how the log is rendered/downloaded.