ownCloud releases Security Advisories

The security advisories address three critical vulnerabilities with one being reported as exploited in the wild

Threat ID:: CC-4412
Threat Severity:: Medium
Published:: 28 November 2023 1:58 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

The security advisories address three critical vulnerabilities with one being reported as exploited in the wild

Affected platforms

The following platforms are known to be affected:

Versions: graphapi 0.2.0 - 0.3.0, core 10.6.0 - 10.13.0, oauth2 prior to 0.6.1

ownCloud

Threat details

Introduction

ownCloud have released security advisories to address three critical vulnerabilities.

CVE-2023-49103 has a CVSSv3 score of 10.0 and could allow an unauthenticated, remote attacker to access sensitive information including ownCloud admin passwords, mail server credentials, and license keys.
CVE-2023-49105 has a CVSSv3 score of 8.7 and is a validation bypass vulnerability that could allow an attacker to redirect callbacks to a Top Level Domain controller by the attacker.
CVE-2023-49104 has a CVSSv3 score of 9.8 and is an authentication bypass vulnerability that could allow an unauthenticated attacker to access, modify or delete any file if the username of the victim is known and the victim has no signing-key configured (which is the default).

Exploitation in the wild of CVE-2023-49103

Following public disclosure of a proof of concept, there have been exploitation attempts in the wild observed for CVE-2023-49103.

Remediation advice

Affected organisations are encouraged to review the ownCloud Security Advisories and apply the relevant mitigations.

Remediation steps

Type	Step
Guidance	Delete the 'owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php' file, disable the 'phpinfo' function in Docker containers, and change potentially exposed secrets like the ownCloud admin password, mail server, database credentials, and Object-Store/S3 access keys. https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
Guidance	Deny the use of pre-signed urls if no signing-key is configured for the owner of the files. https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
Guidance	Harden the validation code in the oauth2 app. As a workaround you can disable the “Allow Subdomains” option to disable the vulnerability. https://owncloud.com/security-advisories/subdomain-validation-bypass/

Definitive source of threat updates

https://owncloud.com/security

CVE Vulnerabilities

Status Published

CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.

Status Published

CVE-2023-49104

An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker.

Status Published

CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

Last edited: 28 November 2023 1:59 pm