Nextcloud Contacts vulnerable to Stored XSS en la aplicación Contacts a través del campo de organización y título

An attacker exploiting this XSS vulnerability could inject arbitrary CSS into a user's Nextcloud Contacts App interface. While JavaScript execution is blocked by Nextcloud's content security policy, malicious CSS can still be used to alter the appearance of the page, potentially stealing sensitive information displayed on the screen through techniques like CSS injection to overlay forms or manipulate element visibility. The impact is primarily client-side, but could be leveraged for phishing or to subtly compromise user trust. The blast radius is limited to users interacting with the Contacts App within the affected Nextcloud instance.

Organizations and individuals using Nextcloud with the Contacts App installed are at risk. This includes users who rely on Nextcloud for contact management and synchronization, particularly those with shared hosting environments where multiple users may be affected by a single vulnerable instance.

• php: Examine Nextcloud application logs for unusual CSS injection attempts targeting the Contacts App. Search for patterns resembling CSS code within the organization or title fields.

grep -i 'background-color:|color:|font-family:' /path/to/nextcloud/data/nextcloud/apps/contacts/db/contacts.xml

• generic web: Monitor Nextcloud instance access logs for requests containing suspicious CSS code in the organization or title parameters.

curl -I 'https://your-nextcloud-instance/index.php/apps/contacts/edit.php?id=123&organization=<script>alert(1)</script>' | grep Content-Type

1. 2025-12-05Disclosure

   disclosure

1. Reservado2025-12-04
2. Publicada2025-12-05
3. Modificada2025-12-08
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-66554 is to upgrade the Nextcloud Contacts App to version 5.5.4, 6.0.6, or 7.2.5. If immediate upgrading is not possible, consider implementing strict input validation on the organization and title fields within the Contacts App to prevent the injection of potentially malicious CSS. While a WAF might offer some protection, it is not a reliable solution for this type of XSS vulnerability. After upgrading, verify the fix by attempting to inject CSS code into the organization and title fields and confirming that it is properly sanitized.