Brother
Professional
- Messages
- 2,590
- Reaction score
- 539
- Points
- 113
The developers gave recommendations for mitigating the consequences, so you should not delay them.
Developers of the ownCloud open source software used for syncing data and working together with files, warned on November 21 about three critical vulnerabilities that can be used to disclose confidential information and modify files.
Below is a brief description of the vulnerabilities, and it seems that CVE identifiers have not yet been assigned to them:
Next, let's talk about each drawback in a little more detail.
The implementation of the first vulnerability depends on a third-party library that provides the URL. Accessing this URL reveals PHP configuration details (phpinfo), including important server environment variables such as ownCloud administrator passwords, mail server credentials, and license key.
ownCloud developers recommend that administrators take the following measures to protect themselves from this vulnerability:
The second vulnerability allows you to access, modify, or delete any file without authentication if the victim's username is known and the signature key is not configured.
The third vulnerability is related to improper access control, which allows an attacker to "pass a specially crafted redirect URL that bypasses the verification code and thus allows the attacker to redirect callbacks to a TLD controlled by the attacker."
In addition to adding stricter measures to the verification code in the oauth2 application, ownCloud representatives also suggested that users disable the "Allow Subdomains" option as a workaround.
Of course, one of the best solutions besides temporary fixes is to install security updates for the affected software. An untimely software update opens the door to cyberattacks for hackers, so administrators are strongly encouraged to pay close attention to upcoming security updates and install them quickly.
Developers of the ownCloud open source software used for syncing data and working together with files, warned on November 21 about three critical vulnerabilities that can be used to disclose confidential information and modify files.
Below is a brief description of the vulnerabilities, and it seems that CVE identifiers have not yet been assigned to them:
- First vulnerability: Exposing sensitive credentials and configuration in container deployments. Affects graphapi versions from 0.2.0 to 0.3.0 (CVSS score: 10.0).
- The second vulnerability: bypassing WebDAV Api authentication using pre-signed URLs. Affects major versions from 10.6.0 to 10.13.0 (CVSS score: 9.8).
- Third vulnerability: subdomain verification bypass affecting oauth2. Affects versions up to 0.6.1 (CVSS score: 9.0).
Next, let's talk about each drawback in a little more detail.
The implementation of the first vulnerability depends on a third-party library that provides the URL. Accessing this URL reveals PHP configuration details (phpinfo), including important server environment variables such as ownCloud administrator passwords, mail server credentials, and license key.
ownCloud developers recommend that administrators take the following measures to protect themselves from this vulnerability:
- delete a file «owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php»;
- disable the "phpinfo" feature;
- change secret data (administrator passwords, mail server and database credentials).
The second vulnerability allows you to access, modify, or delete any file without authentication if the victim's username is known and the signature key is not configured.
The third vulnerability is related to improper access control, which allows an attacker to "pass a specially crafted redirect URL that bypasses the verification code and thus allows the attacker to redirect callbacks to a TLD controlled by the attacker."
In addition to adding stricter measures to the verification code in the oauth2 application, ownCloud representatives also suggested that users disable the "Allow Subdomains" option as a workaround.
Of course, one of the best solutions besides temporary fixes is to install security updates for the affected software. An untimely software update opens the door to cyberattacks for hackers, so administrators are strongly encouraged to pay close attention to upcoming security updates and install them quickly.
Last edited:
