Critical OwnCloud Vulnerability Exposes Sensitive Data

CVECVE-2023-49103
CVSScvssV3_1: 10
SourceCVE-2023-49103

OwnCloud, the popular open source file sharing and collaboration platform, was found to have a vulnerability that could expose sensitive configuration details and credentials.

The issue lies in a third-party library used by the ownCloud graphapi app. When accessed, this library would output the full PHP environment details via phpinfo(), including any environment variables set. In containerized deployments of ownCloud, these often include the admin password and other credentials.

An attacker could simply view this phpinfo page to gather passwords, license keys, mail server configs and other private information stored in environment variables. While disabling the graphapi app helps, it does not fully address the problem.

phpinfo() also reveals extensive details about the server that could aid an attacker in exploiting other vulnerabilities. Even without containerization, this provides too much intelligence about the system.

OwnCloud users are recommended to update to versions 0.2.1 and 0.3.1 or later which fix this vulnerability. Admins should also consider hardening environment variables and limiting what’s exposed to apps. Regularly reviewing app permissions and available information also helps minimize risks.

References