Pre-signed WebDAV URL authentication bypass in ownCloud grants full file access (CVE-2023-49105)
Hunt.io published evidence this week that a suspected Chinese-speaking operator used this pre-signed-URL bypass to breach a Philippine nuclear research agency and a naval contractor, so unpatched ownCloud instances remain a demonstrated live target for data theft.
ownCloud core 10.6.0 through 10.13.0 accepts pre-signed WebDAV URLs even when the file owner has no signing-key configured, letting an unauthenticated attacker who knows a valid username read, modify, or delete any of that user's files. Hunt.io documents this flaw being used as the initial access vector in an intrusion that exfiltrated sensitive records from two Philippine organizations.
Affected: ownCloud core (owncloud_server) 10.6.0 through 10.13.0 (fixed in 10.13.1)
How to Test
Confirm your ownCloud core version is below 10.13.1; identify user accounts with no signing-key configured, since those are the exploitable targets; review WebDAV access logs for pre-signed URL requests against user accounts that never configured a signing key, per the detection guidance in the Hunt.io report.
How to Patch
Upgrade owncloud/core to 10.13.1 or later, which rejects pre-signed URLs for users without a configured signing-key; the vendor advisory for the WebDAV pre-signed URL authentication bypass is published at owncloud.com/security-advisories.