CVE-2023-49105

The vulnerability results from improper handling of pre-signed URLs in the WebDAV API. The system accepts requests signed with a pre-signed URL even when the file owner does not have a signing-key configured. An attacker can craft such a request by providing only the known login of the victim and gain full access to their resources without providing a password or authentication token.

An attacker can without authentication read, modify, or permanently delete any files belonging to a user whose username is known to them — resulting in complete compromise of data confidentiality, integrity, and availability.

Update ownCloud Server to version 10.13.1 or later. As a workaround, you can configure a signing-key for each user account. Details in the vendor's official security advisory: https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/

ownCloud Server versions 10.6.0 through 10.13.0 (versions before 10.13.1)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.