Date: 4/12/2023 | Prepared by: Joel D'Souza, Vulnerability Security Analyst
The purpose of this bulletin is to address three recently disclosed CRITICAL-risk vulnerabilities present in the ownCloud file-sharing platform.
As these vulnerabilities allow potential attackers to extract administrator credentials and sensitive data from the platform, the Triskele Labs team advises that all organisations using this system follow the remediation steps outlined in the subsequent sections.
The Australian Cyber Security Centre (ACSC) has recently seen mass exploitation of these vulnerabilities and has published an alert addressing them on November 29th, 2023.
Additionally, the US Cybersecurity and Infrastructure Security Agency (CISA) has included CVE-2023-49103 in its Known Exploitable Vulnerabilities (KEV) list as they have found it to be weaponised and actively exploited.
Containerised deployments through Docker have also been targeted and successfully exploited, according to ownCloud.
On November 21st, 2023, ownCloud published the security advisory targeting three critical vulnerabilities (CVE-2023-49103, CVE-2023-49104, and CVE-2023-49105) with mitigation actions on their website.
Each vulnerability exposed sensitive information and provided an easily accessible attack path to potential threat actors. The details of the vulnerabilities are listed below.
While individually, each of these vulnerabilities poses a significant threat, collectively, they rapidly increase the likelihood of exploitation.
As such, any ownCloud instance should be treated as an optimal target for a threat actor and patched as a priority for the business to prevent exfiltration of data and leakage of Personally Identifiable Information (PII) and other sensitive data.
If you are utilising an ownCloud Server instance below version 10.13.3, we recommend reviewing the server logs for unusual activity. Triskele Labs recommends upgrading to ownCloud version 10.13.3 immediately to ensure permanent mitigation.
In addition to the update, please refer to the following vendor security releases for additional mitigation steps:
Organisations can check their ownCloud instance for the following Indicators of Compromise (IoCs) in vulnerable versions of ownCloud provided by Cybersecurity company Rapid7 for CVE-2023-49103:
Check for an HTTP GET request to a URI path containing the following in the Apache server’s access logs:
/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php
The indicator of a successful exploitation attempt will be an HTTP 200 response.
Currently the successful exploitation of CVE-2023-49104 and CVE-2023-49105 has not been known to generate artifacts or logs that can be reproduced consistently.
This bulletin will be updated if additional detection information is released.
Triskele Labs DefenceShield customers with Assess (our Vulnerability Scanning service) are currently being evaluated.
All customers with our Monitor service (24x7x365 Security Operations Centre, Managed Detection and Response) are - as always - being monitored for Indicators of Compromise (IOCs) and other suspicious activity.
References used for the generation of this release:
