# CVE-2023-49103: OwnCloud - Information Disclosure

> Live exploitation tracking for CVE-2023-49103 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-49103

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** OwnCloud graphapi
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** file_sharing

## Description

An issue was discovered in OwnCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the OwnCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if OwnCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.

## CrowdSec analysis

[CVE-2023-49103](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-49103) is a critical vulnerability affecting OwnCloud, where an exposed endpoint can leak detailed PHP configuration information, including sensitive environment variables that may contain credentials or license keys.

CrowdSec has been tracking this vulnerability and its exploits since 28th of November 2023.

CrowdSec network data shows that most actors exploiting CVE-2023-49103 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-49103 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-49103 is currently experiencing high visibility and active exploitation across the internet.

Observed exploitation attempts are directed at the endpoint that serves PHP environment details, potentially revealing sensitive information to unauthorized parties.

## Timeline

- 2023-11-21: CVE Published. CVE-2023-49103 is published to NVD.
- 2023-11-28: Rule Released. CrowdSec releases a rule to detect CVE-2023-49103 exploitation attempts against the CrowdSec Network.
- 2023-11-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-49103 for the first time.
- 2023-11-30: CISA KEV. CVE-2023-49103 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2023-12-21: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49103.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-49103) follows observed exploitation activity for CVE-2023-49103. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.