Cyber

What changed

A significant vulnerability has been identified in ownCloud versions prior to 10.13.1, which allows attackers to exploit improper authentication mechanisms. This flaw enables unauthorized users to access, modify, or delete files if they know the username of a target user and the target has not configured a signing-key.

The issue arises from the acceptance of pre-signed URLs without a signing-key, making it critical for users to assess their configurations.

Who is affected

This vulnerability impacts various users and organizations utilizing ownCloud, particularly those who have not implemented signing-keys for their file ownership.

The earliest affected version is 10.6.0, meaning any installations from this version up to 10.13.1 are at risk.

• ownCloud users without signing-keys configured.
• Organizations relying on ownCloud for file storage and collaboration.
• Developers and administrators managing ownCloud installations.

What to do

It is imperative for users and administrators to upgrade to ownCloud version 10.13.1 or later to mitigate this vulnerability. Additionally, configuring signing-keys for file ownership is strongly recommended to enhance security.

Conduct a thorough review of current configurations and ensure that all users are aware of the risks associated with improper authentication.

• Upgrade to ownCloud version 10.13.1 or later immediately.
• Configure signing-keys for all file owners to prevent unauthorized access.
• Review and audit user permissions and configurations regularly.

What changed

An information disclosure vulnerability has been discovered in the ownCloud GraphAPI, specifically in versions 0.2.x prior to 0.2.1 and 0.3.x prior to 0.3.1. The vulnerability arises from the use of a third-party library, GetPhpInfo.php, which, when accessed, reveals sensitive configuration details of the PHP environment.

This exposure includes critical environment variables that may contain sensitive information such as admin passwords, mail server credentials, and license keys, particularly in containerized deployments.

Who is affected

The vulnerability impacts users of the ownCloud platform utilizing the affected versions of the GraphAPI app. Organizations relying on ownCloud for file sharing and collaboration should be particularly vigilant.

Additionally, any deployments that utilize containerization may be at greater risk due to the potential exposure of sensitive environment variables.

• ownCloud users with versions 0.2.x before 0.2.1
• ownCloud users with versions 0.3.x before 0.3.1
• Organizations using containerized deployments of ownCloud
• Developers integrating the GraphAPI into their applications

What to do

To mitigate this vulnerability, it is crucial for affected users to upgrade to the latest versions of the ownCloud GraphAPI. Version 0.2.1 or later for the 0.2.x series and version 0.3.1 or later for the 0.3.x series should be implemented immediately.

Additionally, review and restrict access to the GetPhpInfo.php library to prevent unauthorized access to sensitive information.

• Upgrade to ownCloud GraphAPI version 0.2.1 or later
• Upgrade to ownCloud GraphAPI version 0.3.1 or later
• Restrict access to the GetPhpInfo.php library
• Conduct a security audit to identify any exposed sensitive information