# XSS in desktop client via invalid server address on login form

Nextcloud Windows desktop client rendered attacker-controlled HTTP error responses in an embedded IE-based alert box, allowing HTML injection and local file execution via file:// links.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: jplopezy
- Disclosed: 2020-08-17
- CVE: CVE-2020-8189
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/685552
- Library page: https://bugbountylibrary.com/r/h1%3A685552
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:medium tech:windows technique:source-review vuln:xss

**Target:** Nextcloud Windows desktop client login form error dialog
**Root cause:** The desktop client's error dialog renders the raw HTTP response body from an invalid server address using an embedded IE control with elevated local permissions, without sanitizing HTML.
**Steps:**
1. Point the Nextcloud desktop client login form at an attacker-controlled server address.
2. Configure the server to return an error response (e.g. 403) whose body contains HTML such as `<A HREF="file:///C:/WINDOWS/system32/calc.exe">CALC.EXE</A>`.
3. Observe the client displays the response in a small alert window that interprets HTML like IE.
4. Click the injected link to launch a local executable (calc.exe) without confirmation.
**How found:** Researcher noticed the error dialog rendered HTML from the server response (cross-zone behavior) and tested whether file:// links would execute local binaries, confirming calc.exe launched.
**Exploitation:** Attacker controls the server address entered in the login form and returns a crafted error body; the client's embedded IE-based dialog renders it, letting the victim click a file:// link to execute a local binary.
**Insight:** Desktop clients that render server error bodies in embedded browser controls (IE/WebView) inherit that engine's local-zone privileges; test error/exception dialogs with HTML and file:// links, not just the main UI.