QID 150753
Date Published: 2023-12-06
QID 150753: ownCloud Graph API Information Disclosure Vulnerability (CVE-2023-49103)
ownCloud is an open-source software product for sharing and syncing of files in distributed and federated enterprise scenarios.
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The "graphapi" app relies on a third-party library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.
Affected Versions:
graphapi version from 0.2.0 to 0.3.0
QID Detection Logic (Unauthenticated):
This QID sends a HTTP GET request to "apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.css" endpoint and based on the response confirms if the target application is vulnerable.
Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to leak sensitive information such as ownCloud admin password, mail server credentials, and license key.
Vendors has also advised the following mitigation guidlines:
Delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php.
Change the following secrets:
ownCloud admin password
Mail server credentials
Database credentials
Object-Store/S3 access-key
For more information regarding this vulnerability please refer ownCloud Security Advisory.
- ownCloud Security Advisory -
owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
CVEs related to QID 150753
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| ownCloud Security Advisory |
owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/ |