Critical Vulnerability Discovered in ownCloud

Summary

A vulnerability was discovered in ownCloud, a tool used to share and sync data collaboratively, classified as CVE-2023-49103. MITRE has designated this vulnerability with a CVSS score of 10.0. It is related to the graphapi portion of the application. Because the graphapi relys on a third-party library to provide a URL that contains the phpinfo, the viewing of sensitive data such as ownCloud admin password, mail server credentials, and license key is allowed.

Impact Assessment

Access to the phpinfo can potentially allow sensitive details to be discovered by an attacker which can be used to gather information about the system. The impact of this vulnerability on the environment is directly related to the information stored in the phpinfo file. This information could include passwords, credentials, and a license key according to ownCloud.

If the user had installed ownCloud on a docker-container before Feburary 2023, they are subject to the vulnerability, otherwise they are not.

The affected product is the graphapi, versions 0.2.0 - 0.3.0.

What it means for you

It is necessary to review your organization’s tech stack to determine if ownCloud is used. If so, apply the mitigations recommended by the vendor.

Remediation

ownCloud has not provided a patch but has provided instructions to mitigate this vulnerability. This involves deleting the file “wncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php”. ownCloud has reported that they have disabled the phpinfo function in docker-containers and will be applying various hardening methods to mitigate similar vulnerabilities in future releases.

They also recommend changing the following:

1. ownCloud admin password
2. Mail server credentials
3. Database credentials
4. Object-Store/S3 access-key

Access Point Technology Recommends

Follow vendor recommendations: Due to a patch not being available applying the vendor mitigations/workaround will prevent this vulnerability from being exploited. This includes deleting the GetPhpInfo.php file and changing the secrets mentioned above.

Associated Bulletins

https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/

https://nvd.nist.gov/vuln/detail/CVE-2023-49103