Threat actors started exploiting critical ownCloud flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-49103 | Unauthenticated phpinfo credential leak in ownCloud graphapi CVE-2023-49103 is an unauthenticated information disclosure flaw in ownCloud's graphapi app (0.2.x before 0.2.1 and 0.3.x before 0.3.1), which ships a third-party GetPhpInfo.php page that returns the full PHP phpinfo output when its URL is requested. An attacker with no credentials or user interaction simply accesses that URL over the network, and the phpinfo output reveals all of the webserver's environment variables plus other potentially sensitive configuration details. In containerized deployments these environment variables frequently include the ownCloud admin password, mail server credentials, and license key, giving attackers direct credentials for the server; notably, disabling the graphapi app does not remove the exposed file. Affected deployments are ownCloud installations running the vulnerable graphapi versions, especially ownCloud Docker images built after February 2023, while containers built before February 2023 are not vulnerable to the credential disclosure. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-11-30, the EPSS score is 78.4% (top percentile), and public reporting says threat actors have begun exploiting the flaw, though no public PoC is known. Do: Upgrade the graphapi app to version 0.2.1 or 0.3.1, and note that simply disabling the app is not sufficient — ensure the GetPhpInfo.php file is removed per vendor instructions. Operators of containerized ownCloud deployments (Docker images from February 2023 onward) should assume the ownCloud admin password, mail server credentials, and license key were exposed, rotate them, and review web logs for requests to the GetPhpInfo.php URL. CISA KEV requires applying vendor mitigations or discontinuing use of the product if mitigations are unavailable. | 7.5 | 78% | KEV |
| largeTens of thousands of internet-exposed ownCloud instances (order of magnitude 10k–100k), within a self-hosted user base in the millions |
Full article281 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 28, 2023
Threat actors started exploiting a critical ownCloud vulnerability (CVE-2023-49103) that can lead to sensitive information disclosure.
ownCloud is an open-source software platform designed for file synchronization and sharing. It allows individuals and organizations to create their own private cloud storage services, giving them control over their data while facilitating collaboration and file access across multiple devices.
The vulnerability, tracked as CVE-2023-49103, resides in the Graphapi app, which relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo).
Exposed information includes all the environment variables of the webserver. According to the advisory, in containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.
The vulnerability impacts ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.
Multiple cybersecurity firms reported that threat actors are already exploiting the vulnerability.
Cybersecurity firm GreyNoise observed the quick exploit in the wild of the issue.
“GreyNoise has observed mass exploitation of this vulnerability in the wild as early as November 25, 2023.” reported the company.
Researchers from Nonprofit cybersecurity organization Shadowserver Foundation have identified over 11,000 ownCloud instances that are exposed to the internet.
Most of the exposed instances are in Germany (2K), followed by the US (1,4K), and France (1,3K).
Cybersecurity firm Onyphe downplayed the impact of the attack, it reported that there are only 675 IP addresses exposing phpinfo() out of 19,453 IP addresses exposed.
Researchers recommend administrators perform the actions described in the ownCloud’s advisory.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ownCloud)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/154928/hacking/owncloud-cve-2023-49103-actively-exploited.html