Exploitation Summary
CVE-2023-49103 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 30, 2023.
EIP tracks 5 public exploits from researchers including creacitysec, dyeat, d0rb, including a Metasploit module auxiliary/gather/owncloud_phpinfo_reader.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a Python script that scans for the presence of phpinfo() output in URLs, specifically targeting CVE-2023-49103 by appending /.css to bypass .htaccess restrictions. It uses multi-threading for efficiency and logs valid URLs to an output file.
Description
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
Exploits (5)
This repository contains a Python script that scans for the presence of phpinfo() output in URLs, specifically targeting CVE-2023-49103 by appending /.css to bypass .htaccess restrictions. It uses multi-threading for efficiency and logs valid URLs to an output file.
The repository contains a Python script that checks for the presence of a vulnerable endpoint in ownCloud (CVE-2023-49103) by sending an HTTP request to a specific path and verifying if the response contains 'phpinfo()'. It does not exploit the vulnerability but scans for its existence.
The PoC exploits CVE-2023-49103, an unauthenticated information disclosure vulnerability in ownCloud's Graph API extension. It fetches sensitive environment variables from the `phpinfo` output and exfiltrates credentials to a reverse shell.
This repository contains a functional exploit for CVE-2023-49103, leveraging a path traversal vulnerability in OwnCloud to execute arbitrary PHP code. The Dockerfile sets up an Apache server hosting a malicious PHP payload designed to trigger the vulnerability.
This Metasploit module exploits an information disclosure vulnerability in ownCloud's graph API, where a test file exposes phpinfo() output to unauthenticated users. It extracts sensitive environment variables such as database credentials, SMTP details, and Redis configurations.
Nuclei Templates (1)
title:"owncloud" || http.title:"owncloud"
title="owncloud"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H