CVE-2022-50891: Owlfiles File Manager XSS Vulnerability

CVE-2022-50891 Overview

CVE-2022-50891 is a Cross-Site Scripting (XSS) vulnerability affecting Owlfiles File Manager version 12.0.1. This vulnerability allows attackers to inject malicious scripts through the path parameter in HTTP server endpoints. Specifically, attackers can craft URLs targeting the download and list endpoints with embedded script tags to execute arbitrary JavaScript in users' browsers.

Critical Impact

Successful exploitation enables attackers to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, or redirection to malicious sites.

Affected Products

• Owlfiles File Manager 12.0.1

Discovery Timeline

• 2026-01-13 - CVE-2022-50891 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2022-50891

Vulnerability Analysis

This reflected Cross-Site Scripting vulnerability exists within the HTTP server component of Owlfiles File Manager. The application fails to properly sanitize user-supplied input in the path parameter before reflecting it back in HTTP responses. When users access the built-in HTTP server functionality to share files, the download and list endpoints accept a path parameter that is directly rendered in the response without adequate encoding or escaping.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents one of the most common web application security weaknesses. Exploitation requires user interaction, as victims must be tricked into clicking a maliciously crafted URL. Additional technical details are available in the VulnCheck Advisory.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the HTTP server module. The application does not sanitize or HTML-encode the path parameter value before including it in server responses. This allows special characters such as <, >, and script tags to pass through unfiltered, enabling injection of arbitrary HTML and JavaScript code.

Attack Vector

The attack vector is network-based and requires social engineering to convince a victim to click on a malicious link. An attacker constructs a URL containing JavaScript code within the path parameter targeting either the /download or /list endpoints of the Owlfiles HTTP server. When a victim clicks the crafted URL while the HTTP server is active, the malicious script executes within their browser context.

The exploitation technique involves embedding script tags directly in the path parameter. For example, an attacker could append <script>alert(document.cookie)</script> to the path parameter in a request to the download endpoint. When the server processes this request and reflects the unsanitized path in its response, the browser interprets and executes the injected script. A proof-of-concept demonstrating this attack is documented on Exploit-DB #51036.

Detection Methods for CVE-2022-50891

Indicators of Compromise

• HTTP requests to Owlfiles server endpoints containing encoded or plaintext <script> tags in the path parameter
• Unusual URL patterns targeting /download or /list endpoints with special characters like <, >, ', or "
• Browser console errors or unexpected script execution when accessing Owlfiles HTTP server

Detection Strategies

• Monitor web server logs for requests containing HTML/JavaScript tags in URL parameters
• Deploy Web Application Firewalls (WAF) with rules to detect XSS patterns in query strings
• Implement Content Security Policy (CSP) headers to detect and prevent inline script execution

Monitoring Recommendations

• Review HTTP server access logs for anomalous path parameter values containing encoded characters
• Set up alerts for requests with common XSS payload signatures such as %3Cscript%3E or javascript:
• Monitor for unusual outbound connections originating from user browsers during Owlfiles sessions

How to Mitigate CVE-2022-50891

Immediate Actions Required

• Disable the HTTP server feature in Owlfiles File Manager when not actively in use
• Avoid clicking links to Owlfiles HTTP server endpoints from untrusted sources
• Update Owlfiles File Manager to the latest available version from the Apple App Store
• Use alternative file sharing methods until a patch addressing this vulnerability is confirmed

Patch Information

Users should monitor the official Skyjos website and the Apple App Store listing for security updates addressing this vulnerability. Check release notes for any patches specifically addressing XSS vulnerabilities in the HTTP server component.

Workarounds

• Disable the built-in HTTP server functionality to eliminate the attack surface entirely
• Restrict HTTP server access to trusted networks only, avoiding exposure to the public internet
• Implement browser extensions or security software that blocks known XSS attack patterns
• Educate users to verify URLs before clicking, especially those containing unusual path parameters

# Recommendation: Keep Owlfiles HTTP server disabled when not in use
# Access Owlfiles settings and ensure HTTP server is turned off
# Only enable temporarily when sharing files with trusted parties on secure networks