A threat actor exploited a two year old ownCloud authentication flaw to steal roughly 9 gigabytes of material from a Philippine nuclear research body, according to threat intelligence firm Hunt.io. The flaw, CVE-2023-49105, is a WebDAV API authentication bypass that lets an attacker access, modify, or delete any file without credentials when the target’s username is known and no signing key is configured, which is ownCloud’s default setting. ownCloud disclosed the bug in November 2023, rating it 9.8 out of 10 on the CVSS scale, and fixed it in version 10.13.1.
Hunt.io said it found an open directory on August 13 staging tooling and exfiltrated data from two separate Philippine organizations. Material pulled from the nuclear research body’s ownCloud instance reportedly included nuclear material account records, a database tied to a research reactor’s core components, employee personal information, and stored credentials. A second, unrelated intrusion targeted a WordPress site run by a Philippine marine engineering and shipbuilding company that services the Philippine Navy. Hunt.io assessed the operator as likely a Chinese speaker based on the language used in code comments and file organization, though it stopped short of attributing the activity to a specific group or state sponsor.
The original insight for defenders is the age of the flaw, not the sophistication of the intrusion. A three year old, publicly disclosed, 9.8 severity bug with a straightforward fix was still enough to reach nuclear material records because the fix depends on an operator enabling a signing key that is not on by default. Any organization running a self hosted ownCloud instance for research or engineering collaboration should treat an unconfigured signing key as an open door, not a theoretical gap, regardless of how long ago the patch shipped. This publication has covered the same pattern elsewhere, including a benefits platform breach that stemmed from a similarly overlooked configuration gap and leaked cloud credentials that retained full admin rights long after they should have been rotated.
Source: ownCloud security advisory
