News Own Your Online External Link Report it
News Own Your Online External Link
  1. Welcome to the National Cyber Security Centre
  2. Alerts
  3. Three critical vulnerabilities affecting ownCloud software

Three critical vulnerabilities affecting ownCloud software

This section contains time sensitive announcements about specific cyber threats, vulnerabilities and scams. Each alert has information you need to be aware of, and what actions to take to mitigate any risk to you or your organisation.

Subscribe to our updates to be notified as soon as we publish an alert.

1:50PM, 28 November 2023

TLP Rating: Clear

Three critical vulnerabilities affecting ownCloud software

The file-sharing service ownCloud has released security advisories for three critical vulnerabilities. 

The first vulnerability, tracked as CVE-2023-49103, allows an attacker to access sensitive information such as mail server credentials, ownCloud admin credentials and the licence key via a URL. CERT NZ is aware of this vulnerabilty being actively exploited.

The second flaw, tracked as CVE-2023-49104, allows an attacker to bypass OAuth 2.0 authentication validation.

The third flaw, CVE-2023-49105, allows an unauthenticated attacker to access, modify or delete files. This affects default configurations of ownCloud core library where no signing key is configured. While this requires knowledge of a username that is not considered a difficult barrier to overcome.

UPDATED: 01/12/2023

What's happening

Systems affected

Check each of the following product versions to determine what vulnerabilities you may be affected by:

CVE-2023-49103

  • ownCloud graphapi 0.2.0 to 0.3.0

CVE-2023-49104

  • oauth 2.0 library earlier than, but not including, 0.6.1

CVE-2023-49105

  • ownCloud 10.6.0 to 10.13.0

What to do

Mitigation

We recommend following the vendor's advice for mitigations against these vulnerabilities.

CVE-2023-49103

  • Delete the file GetPhpInfo.php in the following location:

    owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php

  • Change ownCloud admin password, mail server credentials, database credentials, Object-Store/S3 access-keys.

NOTE: Simply disabling the graphapi application does not eliminate the vulnerability.

CVE-2023-49104

  • ownCloud has recommended hardening the validation code in the oauth2 app.
  • A workaround is to disable the “Allow Subdomains” option.

CVE-2023-49105

  • Update to the latest version of ownCloud Core.
  • Deny the use of pre-signed urls if no signing-key is configured for the owner of the files.

More information

For CVE-2023-49103

For CVE-2023-49104

For CVE-2023-49105

If you require more information or further support, submit a report on our website or contact us on 0800 114 115.

Report an incident