Urgent Security Updates: Critical Vulnerabilities Uncovered in ownCloud File Sharing App

ownCloud, the open-source file sync and sharing solution, has issued a crucial warning about three severe security vulnerabilities that could lead to data breaches, risking exposure of sensitive information such as administrator passwords and mail server credentials.

 

 Vulnerability 1: CVE-2023-49103 (CVSS v3 score: 10)

 

In versions 0.2.0 through 0.3.0 of GUI, a critical vulnerability named CVE-2023-49103 poses a serious threat. This flaw, with a maximum CVSS v3 score of 10, enables the theft of credentials and configuration information in containerized deployments. The issue arises from a dependency on a third-party library that discloses PHP environment details via a URL. This exposure could reveal ownCloud administrator passwords, mail server credentials, and license keys.

 

 Recommended Fix:

 

- Delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php.

- Disable the "phpinfo" function in Docker containers.

- Change potentially exposed secrets like ownCloud admin password, mail server credentials, database credentials, and Object-Store/S3 access keys.

 

It's crucial to note that merely disabling the graphapi app doesn't eliminate the vulnerability. Even in non-containerized environments, the exposed details could be exploited by attackers.

 

 Vulnerability 2: Core Library Authentication Bypass (CVSS v3 score: 9.8)

 

The second vulnerability, with a CVSS v3 score of 9.8, affects ownCloud's core library versions 10.6.0 to 10.13.0. This flaw allows an attacker to bypass authentication, gaining access to, modifying, and deleting any file by knowing the user's username, provided the user has not configured a signing key (default setting).

 

 Proposed Solution:

 

Forbid the use of pre-signed URLs if no signing key is configured for the owner of the file.

 

 Vulnerability 3: Subdomain Validation Bypass (CVSS v3 score: 9)

 

The third flaw, with a CVSS v3 score of 9, relates to the oauth2 library below version 0.6.1. This vulnerability enables an attacker to input a specially crafted redirect URL, bypassing validation code and redirecting callbacks to a malicious domain controlled by the attacker.

 

 Mitigation:

 

- Strengthen the validation code in the Oauth2 app.

- As a temporary workaround, disable the "Allow Subdomains" option.

 

These critical security vulnerabilities, if unaddressed, pose a significant threat to the security and integrity of the ownCloud environment, allowing unauthorized access, file manipulation, deletion, phishing attacks, and more.

 

 Urgent Action Required:

 

ownCloud administrators are strongly urged to implement the recommended fixes and promptly update ownCloud to the latest stable version. This ensures necessary library updates are in place, mitigating the risks posed by these vulnerabilities and safeguarding valuable data. Don't delay – act now to secure your ownCloud environment.