ownCloud vulnerability with most 10 severity rating comes below “mass” exploitation

Safety researchers are monitoring what they are saying is the “mass exploitation” of a safety vulnerability that makes it attainable to take full management of servers working ownCloud, a extensively used open-source filesharing server app.

The vulnerability, which carries the utmost severity ranking of 10, makes it attainable to acquire passwords and cryptographic keys permitting administrative management of a susceptible server by sending a easy Net request to a static URL, ownCloud officers warned final week. Inside 4 days of the November 21 disclosure, researchers at safety agency Greynoise said, they started observing “mass exploitation” of their honeypot servers, which masqueraded as susceptible ownCloud servers to trace makes an attempt to use the vulnerability. The variety of IP addresses sending the online requests has slowly risen since then. On the time this put up went dwell on Ars, it had reached 13.

Spraying the Web

“We’re seeing hits to the precise endpoint that exposes delicate info, which might be thought of exploitation,” Glenn Thorpe, senior director of safety analysis & detection engineering at Greynoise, said in an interview on Mastodon. “In the mean time, we have seen 13 IPs which are hitting our unadvertised sensors, which signifies that they’re just about spraying it throughout the web to see what hits.”

CVE-2023-49103 resides in variations 0.2.0 and 0.3.0 of graphapi, an app that runs in some ownCloud deployments, relying on the best way they’re configured. A 3rd-party code library utilized by the app gives a URL that, when accessed, reveals configuration particulars from the PHP-based surroundings. In final week’s disclosure, ownCloud officers mentioned that in containerized configurations—akin to these utilizing the Docker virtualization device—the URL can reveal knowledge used to log into the susceptible server. The officers went on to warn that merely disabling the app in such circumstances wasn’t enough to lock down a susceptible server.

The ownCloud advisory defined:

The “graphapi” app depends on a third-party library that gives a URL. When this URL is accessed, it reveals the configuration particulars of the PHP surroundings (phpinfo). This info consists of all of the surroundings variables of the webserver. In containerized deployments, these surroundings variables could embrace delicate knowledge such because the ownCloud admin password, mail server credentials, and license key.

It’s vital to emphasise that merely disabling the graphapi app doesn’t get rid of the vulnerability. Moreover, phpinfo exposes varied different doubtlessly delicate configuration particulars that might be exploited by an attacker to assemble details about the system. Subsequently, even when ownCloud shouldn’t be working in a containerized surroundings, this vulnerability ought to nonetheless be a trigger for concern.

Not all safety practitioners regard the vulnerability as posing a widespread risk, the best way different vulnerabilities—most lately the vulnerability tracked as CVE-2023-4966 and CitrixBleed—have. Particularly, unbiased researcher Kevin Beaumont has noted that the CVE-2023-49103 vulnerability wasn’t launched till 2020, isn’t exploitable by default, and was solely launched in containers in February.

“I don’t suppose anyone else really checked if the susceptible function is enabled,” he mentioned in an interview. What’s extra, an ownCloud Web page confirmed graphapi had fewer than 900 installs on the time this put up went dwell on Ars. ownCloud officers didn’t instantly reply to an e-mail in search of technical particulars of the vulnerability and the exact circumstances required for it to be exploited.

Given the potential risk posed by CVE-2023-49103, there’s nonetheless room for legit concern. In keeping with safety group Shadowserver, a current scan revealed more than 11,000 IP addresses internet hosting ownCloud servers, led by addresses in Germany, the US, France, Russia, and Poland. Even when solely a small fraction of the servers are susceptible, the potential for hurt is actual.

“Not surprisingly given ease of exploitation we have now began seeing OwnCloud CVE-2023-49103 makes an attempt,” Shadowserver officers wrote. “This can be a CVSS 10 disclosure of delicate credentials & configs in containerized deployments. Please comply with ownCloud advisory mitigation steps.”

Extra high-severity ownCloud vulnerabilities

Another excuse for concern: ownCloud lately mounted two different high-severity vulnerabilities, together with CVE-2023-94105, which has a severity ranking of 9.8. The flaw permits for an authentication bypass within the WebDAV API utilizing pre-signed URLs. Hackers can exploit it “to entry, modify or delete any file with out authentication if the username of the sufferer is thought and the sufferer has no signing-key configured (which is the default),” ownCloud officers warned. The vulnerability impacts the WebDAV API in ownCloud variations 10.6.0 to 10.13.0.

A 3rd vulnerability tracked as CVE-2023-94104 is a subdomain validation bypass flaw with a severity ranking of 8.7. Hackers can exploit it utilizing a redirect URL, making it attainable to redirect callbacks to a website managed by the attacker.

To repair the ownCloud vulnerability below exploitation, ownCloud suggested customers to:

Delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/checks/GetPhpInfo.php. Moreover, we disabled the phpinfo operate in our docker-containers. We are going to apply varied hardenings in future core releases to mitigate comparable vulnerabilities.

We additionally advise to vary the next secrets and techniques:
– ownCloud admin password
– Mail server credentials
– Database credentials
– Object-Retailer/S3 access-key

Whereas there aren’t any studies of the opposite two vulnerabilities being actively exploited, customers ought to comply with the directions ownCloud has offered here and here.

In current months, vulnerabilities in file sharing apps akin to WS-FTP server, MOVEit, and IBM Aspera Faspex, and GoAnywhere MFT have enabled the compromise of hundreds of enterprise networks. Anybody who ignores the risk posed by the lately mounted ownCloud flaws does so at their very own peril.