CVE-2023-49105

What is ownCloud?

ownCloud is a widely deployed open-source content-collaboration and file-sync/share platform — the self-hosted counterpart to services like Dropbox or SharePoint. The owncloud/core PHP application exposes a WebDAV API that clients (desktop, mobile, browser) use to upload, download, and manage files. Because ownCloud instances are typically internet-facing and hold an organization's entire document store, an unauthenticated flaw in the file API is a direct path to mass data theft, tampering, and destruction.

Overview

CVE-2023-49105 is an authentication-bypass vulnerability in the ownCloud core WebDAV API. When a WebDAV request is authenticated with a pre-signed URL, the signature validation can be circumvented: if the targeted user has no signing key configured, the API accepts crafted requests as that user. An attacker who knows (or can guess) a valid username can therefore read, write, or delete any of that user's files — and, depending on privileges, files across the instance — without valid credentials.

It was disclosed alongside two sibling issues in ownCloud's November 2023 advisory wave: CVE-2023-49103 (the critical graphapi phpinfo secret-disclosure bug that leaked admin passwords and credentials) and CVE-2023-49104 (a subdomain-validation bypass in the OAuth2 app). In practice attackers chained these: CVE-2023-49103 harvested credentials and configuration, and CVE-2023-49105 gave direct file-level access to the WebDAV store. All three saw rapid opportunistic exploitation across exposed instances.

Affected Versions

The definitive remediation is upgrading core to 10.13.1 or newer. Instances where every user has a properly configured signing key are less exposed, but the fix should still be applied.

Technical Details

The root cause is improper authentication (CWE-287) in how the WebDAV API validates pre-signed URL requests:

• ownCloud supports pre-signed URLs so that clients can grant time-limited, signed access to a file operation without re-sending credentials on every request. The signature is computed with a per-user signing key.
• The validation logic did not correctly enforce that a signing key existed and matched. When the targeted user had no signing key set, the signature check could be satisfied by an attacker-crafted request, effectively authenticating as that user.
• Because the WebDAV API is the primary file-access surface, a successful bypass grants full CRUD (create/read/update/delete) access to the victim's files.

The attack is unauthenticated, network-based, low-complexity, and requires no user interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only prerequisite is knowing a valid username — often trivially enumerable or obtainable via the co-disclosed CVE-2023-49103 information disclosure.

Discovery

The vulnerability was identified and disclosed by the ownCloud security team as part of a coordinated November 2023 advisory batch covering the core, graphapi, and oauth2 components. ownCloud published dedicated security advisories for each of the three CVEs the same week.

Exploitation Context

The ownCloud November 2023 advisories drew immediate attacker attention. Mass scanning and exploitation of CVE-2023-49103 began within days of disclosure and was tracked by multiple threat-intelligence groups (Greynoise, Shadowserver), with tens of thousands of exposed ownCloud instances identified on the public internet. CVE-2023-49105 was exploited as part of the same campaign wave, giving attackers direct file access once instances were located. CISA added CVE-2023-49103 to the KEV catalog in late 2023; CVE-2023-49105 was added to the KEV catalog on 2026-08-27, formalizing confirmed exploitation of the WebDAV bypass and requiring federal remediation.

Remediation

1. Upgrade ownCloud core to 10.13.1 or later — this is the authoritative fix for the pre-signed URL bypass.
2. Patch the sibling CVEs at the same time. Remove/patch the vulnerable graphapi app (CVE-2023-49103) and update the oauth2 app (CVE-2023-49104); these were exploited together.
3. Rotate all secrets that may have been exposed via CVE-2023-49103 — ownCloud admin password, mail server credentials, database credentials, and any Object-Store/S3 access keys.
4. Ensure every user has a signing key configured, which closes the specific no-signing-key condition this flaw abuses.
5. Restrict internet exposure. Place the instance behind a VPN or IP allowlist where feasible, and put a WAF in front of the WebDAV endpoints.
6. Review WebDAV and web-server access logs for anomalous pre-signed URL requests, unexpected file reads/writes/deletes, and access from unfamiliar IPs during and after November 2023.