# [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only

user_oidc Safari workaround reflects unescaped authorization_endpoint into a meta-refresh HTML response, yielding stored XSS limited by strict CSP.

- Payout: hidden
- Severity: low
- Program: Nextcloud
- Found by: lauritz
- Disclosed: 2022-12-18
- CVE: CVE-2022-39338
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1687410
- Library page: https://bugbountylibrary.com/r/h1%3A1687410
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:oidc tech:php technique:source-review vuln:xss

**Target:** OIDC login controller / authorization endpoint redirect
**Root cause:** The Safari session workaround builds an HTML meta-refresh string by concatenating the IdP-supplied authorization_endpoint without HTML encoding, so a malicious discovery document injects markup.
**Steps:**
1. Run `docker run -p 8081:80 nextcloud:latest` and enable user_oidc
2. Configure provider with discovery endpoint pointing to attacker JSON returning `authorization_endpoint` of `'" http-equiv=><svg/onload=alert(document.domain)>`
3. Visit `http://localhost:8081/login` with a Safari user-agent
4. Observe DataDisplayResponse containing injected `<svg/onload=...>` in meta refresh; CSP blocks execution
**How found:** Code review of LoginController spotted the Safari-specific branch concatenating `$url` into raw HTML without encoding, then tested with a controlled discovery endpoint returning a crafted authorization_endpoint.
**Exploitation:** Attacker controls the OIDC discovery document (or its authorization_endpoint); when a Safari user starts login, the injected markup is rendered in the meta-refresh response. Execution is blocked by `default-src 'none'` CSP, so impact is limited to markup injection.
**Insight:** Look at browser-specific workaround branches that emit raw HTML (meta refresh, redirects) — they often bypass the normal templating/escaping path; check whether CSP actually blocks the injected vector before rating impact.