CVE-2023-49105
About
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
Rainforest analyst review
ownCloud accepts pre-signed URLs even when the file owner has no signing key configured. A pre-signed URL is supposed to be validated against the owner's secret key, but when no key exists there is nothing to validate against, so the check passes trivially. An attacker who merely knows a victim's username can craft URLs that the server accepts as authenticated and use them to read, modify, or delete that user's files with no credentials at all.
This landed as one of a trio of serious ownCloud flaws disclosed in late 2023, and the set was mass-scanned and exploited within weeks because ownCloud servers are internet-facing file stores holding exactly the documents organizations most want kept private. The precondition — an owner without a configured signing key — is common in real deployments. Upgrade to 10.13.1 or later, ensure signing keys are configured, and given the disclosure-to-exploitation speed, review access logs for anomalous file operations against known usernames.
References
Related CVEs
Frequently asked questions
What is CVE-2023-49105?
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
How severe is CVE-2023-49105?
CVE-2023-49105 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2023-49105 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2023-49105?
Public advisories list the following as affected: owncloud server. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-49105?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.