CVE-2021-35946
📋 TL;DR
In ownCloud versions before 10.8, a user with access to a federated share and the database can modify permissions to elevate their own privileges. This affects ownCloud instances with federated sharing enabled, allowing attackers to gain unauthorized access or control.
💻 Affected Systems
- ownCloud
📦 What is this software?
Owncloud by Owncloud
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains administrative privileges, leading to full compromise of the ownCloud instance, data theft, or system takeover.
Likely Case
An authenticated user escalates privileges to access or modify sensitive files and settings they shouldn't have permission for.
If Mitigated
With proper access controls and monitoring, impact is limited to minor unauthorized access, quickly detected and contained.
🎯 Exploit Status
Exploitation requires authenticated access to a federated share and database interaction, making it moderately complex but feasible for skilled attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ownCloud 10.8 or later
Vendor Advisory: https://owncloud.com/security-advisories/cve-2021-35946/
Restart Required: Yes
Instructions:
1. Backup your ownCloud instance and database. 2. Update ownCloud to version 10.8 or later via the official update mechanism. 3. Restart the ownCloud service to apply changes. 4. Verify the update by checking the version in the admin panel.
🔧 Temporary Workarounds
Disable Federated Sharing
allTemporarily disable federated sharing to prevent exploitation until patching is possible.
Edit ownCloud config.php and set 'files_sharing.federation.enable' => false
🧯 If You Can't Patch
- Restrict database access to only trusted users and applications.
- Implement strict monitoring and logging for permission changes and database queries.
🔍 How to Verify
Check if Vulnerable:
Check the ownCloud version in the admin panel or via command 'php occ status' and verify if it is below 10.8.Check Version:
php occ status | grep versionVerify Fix Applied:
After updating, confirm the version is 10.8 or higher using 'php occ status' or the admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual permission changes in ownCloud logs
- Database queries modifying share permissions
Network Indicators:
- Suspicious API calls to federated share endpoints
SIEM Query:
Example: search for 'permission update' or 'federated share' in ownCloud application logs with high severity.