OwnCloud - Information Disclosure (CVE-2023-49103)
Description
An issue was discovered in OwnCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the OwnCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if OwnCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
psychologyCrowdSec Analysis
CVE-2023-49103 is a critical vulnerability affecting OwnCloud, where an exposed endpoint can leak detailed PHP configuration information, including sensitive environment variables that may contain credentials or license keys.
CrowdSec has been tracking this vulnerability and its exploits since 28th of November 2023.
CrowdSec network data shows that most actors exploiting CVE-2023-49103 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-49103 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-49103 is currently experiencing high visibility and active exploitation across the internet.
Observed exploitation attempts are directed at the endpoint that serves PHP environment details, potentially revealing sensitive information to unauthorized parties.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-11-21 |
| Rule Released | 2023-11-28 |
| CrowdSec First Seen | 2023-11-28 |
| CISA KEV | 2023-11-30 |
| CISA Remediation Deadline | 2023-12-21 |