CISA Flags ownCloud Flaw Exploited to Steal Philippine Nuclear Records
This digest was compiled by AI from multiple sources — links to the originals are below.
The U.S. Cybersecurity and Infrastructure Security Agency added a critical ownCloud vulnerability to its Known Exploited Vulnerabilities catalog after a Chinese-speaking threat actor used it to steal files from a Philippine nuclear research body. The flaw, CVE-2023-49105, allows unauthenticated file access via WebDAV API authentication bypass. Hunt.io identified the intrusion and attributed it to a Chinese speaker based on simplified Chinese in code comments and logs.
Key Facts
- CISA added CVE-2023-49105, a critical ownCloud WebDAV API authentication bypass flaw with CVSS score 9.8, to its Known Exploited Vulnerabilities catalog on Thursday.
- The vulnerability affects ownCloud core versions 10.6.0 through 10.13.0 and was fixed in version 10.13.1.
- Hunt.io identified an open directory at host 31.58.209.241 containing custom Python scripts and exfiltrated data from two Philippine organizations, including a nuclear research body and a marine engineering company serving the Philippine Navy.
- The threat actor downloaded 176 files totaling about 372 MB from the nuclear research entity and stored them across five staging directories.
- The attacks were attributed to a Chinese speaker due to simplified Chinese in source code comments, docstrings, log output, and folders used to sort stolen data.
Vulnerability Details
CVE-2023-49105 is a WebDAV API authentication bypass that allows an attacker to access, modify, or delete any file without authentication if the victim's username is known and no signing-key is configured, which is the default. ownCloud disclosed the flaw in November 2023, affecting core versions 10.6.0 through 10.13.0, and fixed it in version 10.13.1. An attacker with knowledge of valid usernames could construct signed WebDAV requests accepted by the server as authentication by that user without supplying credentials.
Attack Campaign
Hunt.io found five custom Python scripts in the exposed directory that implement an exploit for CVE-2023-49105. Four scripts target a single account each, while the fifth enumerates the WebDAV directory and logs every download attempt. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret to retrieve files unauthenticated over WebDAV. A separate intrusion exploited a WordPress site managed by a marine engineering and shipbuilding company that provides services to the Philippine Navy.
Attribution and Impact
Hunt.io attributed the attacks to a Chinese speaker based on simplified Chinese in source code comments, docstrings, log output, and folders used to sort stolen data. The threat actor downloaded 176 files totaling about 372 MB from the nuclear research entity and stored them across five staging directories. CISA's addition of the flaw to the KEV catalog follows Hunt.io's report identifying the open directory and the exfiltrated data.
1 source
CISA Flags ownCloud Flaw Exploited to Steal Philippine Nuclear Records
