Hackers Exploit Critical Vulnerability in ownCloud
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-49104 | An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker. NVD description · AI analysis pending | 6.1 | <1% |
| — | ||
| CVE-2023-49105 | Improper Authentication in ownCloud Server Allows Unauthenticated File Access ownCloud Server versions from 10.6.0 up to (but not including) 10.13.1 accept WebDAV pre-signed URLs even when no signing key is configured for the file owner, an improper authentication flaw (CWE-287). A remote attacker who knows a victim's username can therefore access, modify, or delete that user's files without any credentials, with no privileges or user interaction required (CVSS 9.8). Any organization running a self-hosted ownCloud Server instance in the affected version range is exposed, especially internet-facing deployments. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-27, confirming exploitation in the wild, and EPSS assigns a 43.2% probability of exploitation within 30 days (99th percentile). No public proof-of-concept code is known, but recent press reports of attacks against ownCloud (including theft of records at a Philippine research body) indicate active targeting of ownCloud flaws. Do: Upgrade to ownCloud Server 10.13.1 or later immediately, prioritizing internet-facing instances, as the flaw is on CISA's KEV list with BOD 26-04 patching deadlines. Until patched, configure signing keys for users where possible and restrict internet exposure of the pre-signed URL/WebDAV endpoints, and review server logs for unauthenticated file access, modification, or deletion tied to known usernames. If mitigations are not available for a given deployment, follow BOD 26-04 guidance for cloud services or discontinue use of the product. | 9.8 | 43% | KEV |
| largelikely on the order of tens of thousands of self-hosted server deployments worldwide (no authoritative public install counts) |
Full article331 words · extracted from infosecurity-magazine.com · click to collapse
Security experts have urged ownCloud customers to mitigate a critical zero-day vulnerability in its “graphapi” app announced last week, after observing mass exploitation by threat actors.
Security vendor GreyNoise raised the alarm after file server and collaboration platform ownCloud revealed the CVSS 10.0-rated vulnerability on November 21.
“The ‘graphapi’ app relies on a third-party library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo),” ownCloud said at the time.
“This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.”
In short, exploitation could allow malicious actors to take full administrative control of servers running ownCloud.
Read more on CVSS 10.0 vulnerabilities: MOVEit Developer Patches Critical File Transfer Bugs
GreyNoise said that threat actors began exploiting the vulnerability en masse as early as November 25.
“Disabling the app does not entirely resolve the issue, and even non-containerized ownCloud instances are at risk. Docker containers before February 2023 are not affected,” it explained.
Customers are urged to take the mitigation measures suggested by ownCloud: delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php.
The company also advised customers to change their ownCloud admin password, mail server credentials, database credentials and object-Store/S3 access-key.
“This one is concerning because ownCloud is the type of software that home users and small businesses tend to set up and then forget,” explained Bugcrowd founder, Casey Ellis.
“The combination of the impact of this vulnerability and the type of personal/valuable data stored in ownCloud instances provides a wide variety of options for attackers looking to exploit it. I’d be very surprised if we don’t start hearing about ransomed ownCloud instances in the coming days.”
As if that weren’t enough, ownCloud also revealed two additional critical vulnerabilities: an authentication bypass flaw, CVE-2023-49105, that has a CVSS score of 9.8 and a subdomain validation bypass flaw, CVE-2023-49104, which has a score of 8.7.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/hackers-exploit-critical/