WebDAV API Authentication Bypass in ownCloud by ownCloud
CVE-2023-49105

9.8CRITICAL

Key Information:

Vendor

Owncloud

Status
Owncloud
Vendor
CVE Published:
21 November 2023

Badges

📈 Score: 674👾 Exploit Exists🟡 Public PoC🟣 EPSS 43%🦅 CISA Reported📰 News Worthy

What is CVE-2023-49105?

CVE-2023-49105 is a vulnerability affecting the ownCloud platform, specifically in versions prior to 10.13.1. ownCloud is a widely-used open-source software solution that enables file synchronization and sharing among users, allowing for collaborative document management within organizations. This particular vulnerability allows attackers to bypass authentication mechanisms, granting unauthorized access to files stored within ownCloud. If an attacker knows a victim's username and the victim does not have a signing key configured, they can manipulate, access, or delete files without any form of authentication. This flaw arises from the acceptance of pre-signed URLs where no signing key is required, which fundamentally undermines the security measures designed to protect the stored data.

Potential impact of CVE-2023-49105

  1. Unauthorized File Access: Attackers could potentially access sensitive files stored in ownCloud without requiring authentication, leading to exposure of confidential organizational data.

  2. Data Manipulation and Deletion: The vulnerability allows malicious actors to modify or delete critical files, which can disrupt business operations and result in data loss, impacting organizational productivity and integrity.

  3. Increased Risk of Compromise: Since this vulnerability enables remote access without authentication, it opens the door for further attacks. Cybercriminals could leverage this access to deploy additional malicious activities, such as installing ransomware or exfiltrating sensitive information to sell on the dark web.

CISA has reported CVE-2023-49105

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-49105 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

owncloud-exploits
Created by ambionics

News Articles

Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities

An exposed staging server reveals ownCloud pre-signed URL abuse against a Philippine nuclear agency and exploitation of a naval contractor's WordPress website.

2 weeks ago

References

https://owncloud.org/security
https://owncloud.com/security-advisories/webdav-api-authe...

EPSS Score

43% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🦅

    CISA Reported

  • 📰

    First article discovered

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.