Security Research

CVE-2023-49103 + CVE-2023-49105 ownCloud Info Leak + Privilege Escalation to RCE Chain: How PHPinfo Exposure Became the Attacker's Key

Thinking 2023-11-15 7 min read Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
Copper-orange lock with PHP configuration leaking through its keyhole

ownCloud exposes the full PHPinfo page on a few endpoints such as /settings/phpinfo (CVSS 10), and at the same time the WebDAV URL signature defaults to an empty string when the user has not configured a signing key, allowing the attacker to forge a request for any username (CVSS 9.8) — the two CVEs combine into a complete attack chain: PHPinfo exposure gives away ImageMagick / GraphQL information → WebDAV signature forgery lets the attacker impersonate any user → old ImageMagick vulnerability triggers RCE.

Unlock to view this content.