CVE-2023-49103: OwnCloud - Phpinfo Configuration

1. In CISA KEVCISA KEV catalogue30 Nov 2023
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not established: not seen

DescriptionCVE.org

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.

CISA KEV

Listed since 30 Nov 2023 · catalogue entry

Public check

OwnCloud - Phpinfo Configuration · nuclei template in projectdiscovery/nuclei-templates

Weakness

Information Exposure · Information Disclosure

Vendor

ownCloud

Published

November 2023

Band

Exploited in the wild, November 2023

1. 30 Nov 2023
   CISA added it to the KEV catalogue CISA

• NVD entrynvd.nist.gov
• CISA KEV cataloguecisa.gov
• CVE recordcve.org
• Weakness CWE-200cwe.mitre.org
• owncloud.org/securityowncloud.org
• owncloud.com/security-advisories/disclosure-of-sensitive-credentowncloud.com