ownCloud owncloud/core before 10.13.1.

CVE-2023-49105 is an authentication bypass in ownCloud Server's WebDAV API (versions 10.6.0 through 10.13.0, fixed in 10.13.1). The flaw lives in lib/private/Security/SignedUrl/Verifier.php: when a user has no signing-key configured — which is the default state — the server uses an empty string as the PBKDF2-SHA512 secret. Because every other input to the hash (URL, verb, expiry, iteration count) is attacker-controlled, anyone who knows a valid username can forge a pre-signed WebDAV URL and read, overwrite, or delete every file that user owns. No credentials, no session, no interaction required.

The vendor's CRITICAL / 9.8 rating is fully justified and, if anything, understates operational risk. The attack surface is network-reachable by default, the precondition (knowing a username) is trivial — ownCloud exposes usernames in sharing links and federation endpoints — and the default configuration is vulnerable out of the box. CISA added this to the KEV catalog on 2026-08-27 after Hunt.io documented a suspected Chinese-speaking operator exploiting it to exfiltrate ~9 GB of nuclear research data, reactor fuel inventories, and KeePass credential vaults from a Philippine government research agency. Multiple weaponized PoCs have been public since late 2023 (Ambionics pwncloud-webdav.py). There is no plausible friction that narrows this chain — it is point-and-shoot against any internet-facing ownCloud instance running a vulnerable version.

Why this verdict

• No authentication required. The entire chain is unauthenticated — AV:N/PR:N. There is no login, no session, no token to obtain first. This eliminates the most common friction point in critical CVEs.
• Default configuration is vulnerable. The signing-key is empty by default. Administrators must have *proactively* configured a signing secret — a step not mentioned in standard deployment guides — for the vuln to be mitigated. This means virtually 100% of unpatched installs are exploitable.
• Weaponized PoC + nation-state exploitation. Ambionics published a turnkey exploit in 2023. In August 2026, Hunt.io documented a suspected Chinese-speaking operator using custom scripts implementing this exact bypass to exfiltrate nuclear research data from a Philippine government agency. CISA added CVE-2023-49105 to the KEV catalog on 2026-08-27.
• EPSS 96th percentile. At 0.41192, the model places this firmly in the top tier of predicted exploitation probability, consistent with observed activity.
• Role multiplier: ownCloud is deployed as an organizational file-sharing and collaboration platform — it is by definition a data repository holding documents, credentials, and sensitive IP. Compromise grants the attacker access to every file of every user whose signing-key is unconfigured (i.e., all users by default). In the Philippine case, this included reactor databases, personnel files, and KeePass credential vaults. The blast radius is organization-wide data exfiltration plus potential credential-harvest-driven lateral movement. ownCloud instances at government, research, and enterprise organizations routinely hold regulated and classified data — this is a canonical high-value-role deployment, supporting a CRITICAL floor.

Why not higher?

The vendor already rates this 9.8 CRITICAL, the maximum practical score for a Scope:Unchanged vulnerability. There is no higher bucket to assign. A 10.0 would require Scope:Changed, which does not apply here since the compromised component (ownCloud WebDAV) and the impacted component (user files) are within the same security authority.

Why not lower?

Every downgrade factor is absent. The attack is unauthenticated, requires no user interaction, works against default configurations, targets an internet-facing service, has public weaponized exploits, confirmed nation-state exploitation, and a fresh KEV listing. Dropping below CRITICAL would require evidence that ownCloud is rarely internet-exposed or that signing-keys are universally configured — neither is true. The Shodan footprint and the Philippine incident prove otherwise.

1. Block unauthenticated WebDAV pre-signed URL access at WAF/reverse proxy — Add a WAF rule or nginx/Apache rewrite that strips or rejects requests to /remote.php/dav/ containing OC-Signature and OC-Credential query parameters when no valid session cookie is present. Deploy within the noisgate mitigation SLA of ≤ 3 days (CRITICAL). This eliminates the attack vector without requiring an ownCloud upgrade.
2. Restrict ownCloud to VPN/ZTNA access only — Move the ownCloud instance behind a VPN or zero-trust network access gateway so it is not directly internet-reachable. This eliminates the unauthenticated remote attack surface entirely. If business requirements demand external access, enforce SSO/MFA at the gateway layer. Deploy within ≤ 3 days.
3. Force signing-key initialization for all users — Use the occ CLI to generate signing keys for every user account: occ user:setting <user> core signing-key <random-value>. This directly neutralizes the empty-key bypass. Script this across all user accounts immediately.
4. Audit WebDAV access logs for pre-signed URL abuse — Search Apache/nginx access logs for requests containing OC-Signature paired with OC-Credential — especially for the admin account. Cross-reference with known session activity. Any match without a corresponding interactive login is a strong indicator of compromise.

Run this script on the ownCloud server host (or any machine with network access to the instance) as any user. Usage: bash check_cve_2023_49105.sh https://owncloud.example.com. No special privileges required — it only queries the public /status.php endpoint.

#!/usr/bin/env bash
# check_cve_2023_49105.sh — Detect ownCloud CVE-2023-49105 (WebDAV auth bypass)
# Usage: bash check_cve_2023_49105.sh <owncloud_base_url>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <owncloud_base_url>"
  echo "Example: $0 https://owncloud.example.com"
  exit 2
fi

BASE_URL="${1%/}"
STATUS_URL="${BASE_URL}/status.php"

# Fetch version from status.php
RESPONSE=$(curl -sk --max-time 10 "$STATUS_URL" 2>/dev/null) || {
  echo "UNKNOWN — could not reach $STATUS_URL"
  exit 2
}

# Extract versionstring field
VERSION=$(echo "$RESPONSE" | grep -oP '"versionstring"\s*:\s*"\K[^"]+' 2>/dev/null) || {
  echo "UNKNOWN — could not parse version from status.php response"
  exit 2
}

echo "Detected ownCloud version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Affected: 10.6.0 through 10.13.0
# Fixed: 10.13.1+
if [ "$MAJOR" -ne 10 ] 2>/dev/null; then
  echo "UNKNOWN — unexpected major version $MAJOR (expected 10.x)"
  exit 2
fi

if [ "$MINOR" -lt 6 ] 2>/dev/null; then
  echo "PATCHED — version $VERSION is below the affected range (10.6.0–10.13.0)"
  exit 0
elif [ "$MINOR" -lt 13 ] 2>/dev/null; then
  echo "VULNERABLE — version $VERSION is in the affected range (10.6.0–10.13.0)"
  exit 1
elif [ "$MINOR" -eq 13 ] 2>/dev/null; then
  if [ "${PATCH:-0}" -lt 1 ] 2>/dev/null; then
    echo "VULNERABLE — version $VERSION is 10.13.0 (affected)"
    exit 1
  else
    echo "PATCHED — version $VERSION is 10.13.1+ (fixed)"
    exit 0
  fi
else
  echo "PATCHED — version $VERSION is above the affected range"
  exit 0
fi

Sources

1. GreyNoise Labs — The Forgotten ownCloud Vulnerability
2. Ambionics ownCloud Exploits (PoC)
3. Hunt.io — Philippine Nuclear and Naval Targets
4. CISA KEV Addition Alert (2026-08-27)
5. GBHackers — Philippine Nuclear Agency Attack
6. Arctic Wolf — Multiple ownCloud CVEs
7. GitHub Advisory GHSA-585g-f852-v6p4
8. SecurityAffairs — CISA Adds ownCloud to KEV