ownCloud file takeover, actively exploited (CVE-2023-49105) [PoC]

Actively exploited in the wild - CVE-2023-49105 is a critical authentication bypass in ownCloud core 10.6.0 through 10.13.0 that grants unauthenticated attackers the ability to read, modify, or delete any file on the server. The vendor has released a fix in version 10.13.1; update immediately to block ongoing attacks.

Overview

CVE-2023-49105 is an authentication bypass vulnerability that stems from how ownCloud handles pre-signed URLs. When an ownCloud user has no signing-key configured, the system accepts pre-signed URLs without properly verifying the owner’s identity. An attacker who knows the victim’s username can craft a valid pre-signed URL that grants full file access.

The flaw was introduced in version 10.6.0 and affects all releases through 10.13.0. The vulnerability was confirmed by CISA as actively exploited in the wild, with an EPSS score of 11.1% probability of exploitation in the next 30 days, indicating elevated and ongoing threat activity.

Impact

The consequences are severe for any organization running affected ownCloud instances:

• Complete data exposure: Unauthenticated attackers can read any file stored by a victim user, including sensitive documents, credentials, or personal data.
• Data integrity loss: Attackers can modify or delete files, potentially destroying critical business data or injecting malicious content.
• No user interaction required: The attack requires only a known username and network access, making it trivial to execute at scale.

The CVSS score of 9.8 (Critical) reflects the combination of network attack vector, low complexity, no privileges required, and no user interaction needed.

Remediation

Take the following actions immediately:

1. Update ownCloud: Upgrade to version 10.13.1 or later, which properly rejects pre-signed URLs when no signing-key is configured.
2. Audit file activity: Review logs for any suspicious file access patterns that might indicate prior exploitation.
3. Rotate credentials: If you suspect compromise, rotate credentials for users who had files exposed.
4. Monitor for indicators: Watch for unusual URL requests targeting file endpoints that could indicate attempted exploitation.
5. Apply vendor guidance: Consult the ownCloud security advisory for additional hardening recommendations.

Security Insight

This vulnerability highlights a dangerous class of flaws where security mechanisms silently fail when configuration is incomplete. The decision to accept pre-signed URLs without a signing-key effectively disabled authentication for a subset of users, creating an illusion of security while exposing all their data. Attackers are increasingly targeting file-sharing platforms because they concentrate sensitive data in a single, network-accessible location. Organizations should treat file sync-and-share systems as high-value targets and verify that security features fail closed, not open, when misconfigured. For ongoing coverage of such incidents, see our breach reports and security news.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs