CVE-2023-49103
📋 TL;DR
This vulnerability in ownCloud's graphapi app exposes PHP configuration details (phpinfo) via a third-party library URL. When accessed, it reveals webserver environment variables, which in containerized deployments can include sensitive credentials like admin passwords, mail server credentials, and license keys. All ownCloud installations using graphapi versions 0.2.x before 0.2.1 or 0.3.x before 0.3.1 are affected.
💻 Affected Systems
- ownCloud owncloud/graphapi
📦 What is this software?
Graph Api by Owncloud
Graph Api by Owncloud
⚠️ Risk & Real-World Impact
Worst Case
Full credential disclosure including ownCloud admin password, mail server credentials, and license key, leading to complete system compromise and data exfiltration.
Likely Case
Exposure of sensitive environment variables and configuration details enabling reconnaissance and potential credential harvesting.
If Mitigated
Limited information disclosure without sensitive credentials if environment variables are properly secured.
🎯 Exploit Status
Exploitation requires only accessing a specific URL. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: graphapi 0.2.1 or 0.3.1
Vendor Advisory: https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
Restart Required: Yes
Instructions:
1. Update graphapi app to version 0.2.1 or 0.3.1 via ownCloud marketplace or manual installation. 2. Restart the web server. 3. Verify the vulnerable GetPhpInfo.php file is removed.
🔧 Temporary Workarounds
Remove vulnerable file
linuxManually delete the GetPhpInfo.php file from the graphapi app directory
rm /path/to/owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php
Block access via web server
allConfigure web server to block access to the vulnerable endpoint
# Apache: Add to .htaccess
<Files "GetPhpInfo.php">
Require all denied
</Files>
# Nginx: Add to server block
location ~* GetPhpInfo\.php$ {
deny all;
}
🧯 If You Can't Patch
- Remove or disable the graphapi app completely (note: simply disabling may not eliminate vulnerability)
- Review and sanitize all environment variables to remove sensitive credentials
🔍 How to Verify
Check if Vulnerable:
Check if file exists: /apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.phpCheck Version:
Check ownCloud admin panel or run: grep -r 'version' /path/to/owncloud/apps/graphapi/appinfo/info.xmlVerify Fix Applied:
Verify GetPhpInfo.php file is removed and graphapi version is 0.2.1 or 0.3.1📡 Detection & Monitoring
Log Indicators:
- HTTP requests to URLs containing 'GetPhpInfo.php'
- Access to phpinfo output in web logs
Network Indicators:
- Unusual requests to graphapi endpoints
- Traffic patterns indicating reconnaissance
SIEM Query:
web.url:*GetPhpInfo.php OR web.url:*phpinfo*🔗 References
- https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
- https://owncloud.org/security
- https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
- https://owncloud.org/security
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49103
