Critical ownCloud Vulnerabilities Require Urgent Patching

Rohan Timalsina

December 13, 2023 - TuxCare expert team

Recently, ownCloud, a renowned open-source file-sharing software, disclosed three critical security vulnerabilities that demand immediate attention. This article delves into the specifics of these vulnerabilities and offers actionable insights to mitigate the risks associated with them.

Three Critical Vulnerabilities in ownCloud

1. CVE-2023-49103

“graphapi” App Vulnerability (CVSS score: 10.0)

One of the vulnerabilities, tagged as CVE-2023-49103, resides in the “graphapi” app. Here, a third-party library’s URL exposes PHP environment details, including sensitive data such as admin passwords and credentials. To fortify your system against potential threats, ownCloud recommends the deletion of a specific file and the disabling of the ‘phpinfo’ function. This step is crucial to thwart unauthorized access to vital information.

2. CVE-2023-49105

WebDAV API Authentication Bypass (CVSS score: 9.8)

The second vulnerability, CVE-2023-49105, revolves around the WebDAV API and an authentication bypass that allows unauthorized access, modification, or deletion of any file if the victim’s username is known and lacks a signing key. To enhance security, it’s imperative to reassess user authentication mechanisms and implement additional layers of verification, especially for users with vulnerable usernames.

3. CVE-2023-49104

Subdomain Validation Bypass in the OAuth2 App (CVSS score: 9.0)

The third vulnerability, CVE-2023-49104, exposes a subdomain validation bypass in the oauth2 app, enabling attackers to redirect callbacks to a controlled Top-Level Domain (TLD) by bypassing validation. To mitigate this risk, ownCloud suggests reinforcing the validation code and disabling the “Allow Subdomains” option. This proactive approach ensures a robust defense against potential manipulation of the OAuth2 app.

Taking Action to Mitigate Risks

All ownCloud Server instances below version 10.13.3 are affected. ownCloud emphasizes the urgency of updating your system to the latest version and implementing specific actions to mitigate the risks. These actions include deleting vulnerable files, disabling functions prone to exploitation, and reinforcing validation processes within the affected apps.

Active Exploitation of ownCloud Vulnerability

It’s worth noting that CVE-2023-49103 is actively exploited, with reports of mass exploitation observed by cybersecurity researchers. This underscores the importance of immediate action to protect your system against potential threats. Johannes B. Ullrich from the SANS Technology Institute highlights that attacks against ownCloud are not uncommon, with cybercriminals often attempting to exploit old vulnerabilities or weak passwords.

Conclusion

In the face of evolving cyber threats, staying informed and taking proactive measures is essential to safeguard your data. By addressing the disclosed vulnerabilities in ownCloud promptly, users can fortify their systems and contribute to a more secure digital environment. Regular updates, stringent authentication practices, and adherence to recommended security protocols are crucial elements in the ongoing battle against cyber threats.

The sources for this article include a story from TheHackerNews.

Summary